Six principles
The rules every line of Floo follows.
Not aspirations. Hard architectural constraints in the codebase and the infrastructure.
Encrypt by default
TLS 1.2+ in transit. AES-256 at rest. No exceptions, no fallback to anything weaker.
Isolate every tenant
Per-tenant encryption keys. Logically isolated indexes. Row-level scoping in every query.
Audit everything
Every read, write, and admin action logged. Forever queryable. Customer-accessible.
Retain only what you choose
Configurable retention down to hours. Auto-deletion on schedule. Hard-delete on demand.
Detect and respond
Anomaly detection on access patterns. Alerts to security team. Auto-throttle on attack.
Never train on your data
Your call audio, transcripts, and knowledge base are not used to train shared models. Period.
Architecture
How a single byte travels through Floo.
From your customer's voice to your encrypted database, six layers of protection along the way.
End-to-end data flow
Every byte, encrypted twice. Every request, isolated.
Customer
Browser / SDK
TLS 1.2+
In-transit encryption
Edge
DDoS + WAF
App Layer
Auth + tenant isolation
AES-256
At-rest encryption
Database
Tenant-scoped storage
Multi-tenant architecture
Your data never touches another customer's.
Every tenant gets a logically isolated index, a unique encryption key, and row-level scoping in every query. No shared models, no cross-leak, no exception.
Acme Healthtech
8,742 calls / day
Northwind Reports
1,240 calls / day
GlobalTech AE
5,608 calls / day
BluePeak Capital
330 calls / day
Vertex Properties
2,114 calls / day
Lumina Health
917 calls / day
Per-tenant
encryption key
Row-level
DB scoping
Zero
cross-tenant access
Compliance
Standards we live by, paperwork we deliver.
Documents and DPAs available under NDA. Write to security@floo.ai.
SOC 2 Type II
Audit underway. Type I report available under NDA.
HIPAA
BAA available on Enterprise. Battle-tested across healthcare partners.
GDPR
Standard Contractual Clauses, DPA, data-subject rights.
ISO 27001
Targeted for next compliance cycle. Controls in place today.
TLS 1.2+
All connections encrypted in transit. No HTTP fallback.
AES-256
Customer data encrypted at rest, per-tenant keys.
Customer audit log
Trust, then verify, from your dashboard.
Every action (yours, ours, the system's) is on the record in your dashboard. Live preview below.
Audit log · last 24 hours
42 events
API key rotated
admin@acme.co · Key id ravox_***k4d2
2 mins ago
Read transcript
agent@acme.co · Call id call_8x7f9
5 mins ago
Failed login attempt
192.168.1.42 · Auto-blocked, alert sent
11 mins ago
Tenant key re-generated
system · Quarterly rotation
1 hr ago
Data export requested
owner@acme.co · GDPR Art. 20, completed
3 hrs ago
Every read, write, and admin action. Forever auditable.