CheckFlow security, written down plainly.
Where your data lives, how it is protected and backed up, who can reach it, and the policies behind it. Every statement here links to the security statement or the documentation it comes from.
Hosted on Microsoft AzureGDPR and UK GDPRData processing agreement on request
Last updated
CheckFlow runs on Microsoft Azure, in the United States by default, with the EU and other regions available on request. Connections use TLS 1.2 or above, and databases are backed up every 5 to 10 minutes to a paired data centre. Administrators control sign-in, roles and permissions, single sign-on comes with Enterprise, and every checklist keeps an audit trail. GDPR terms, a DPA and the subprocessor list are published.
What a security review usually asks, answered up front.
Known infrastructure, in your region
Microsoft Azure data centres, with EU hosting on request, and EU backups that stay in the EU.
Access you decide
Invitation-only teams, three roles, named permissions, and folder and template permissions on top.
A record of who did what
Every completion, answer and file on a checklist is logged with a name and a time, and template versions are kept for good.
Infrastructure
Hosting, encryption and backups
The technical measures, as set out in CheckFlow’s Statement on Security and Information Security Policy.
Hosted on Microsoft Azure
User data is held in an elastic pool of Microsoft SQL Azure databases. Primary hosting is in the United States. Microsoft runs the physical security of its data centres, which are covered by Microsoft’s independently audited SOC 1 and SOC 2 Type 2 reports and its ISO/IEC 27001 certification.
Statement on SecurityEncrypted in transit
Web connections to CheckFlow use TLS 1.2 and above. Encryption of data at rest is available on dedicated database instances, which Enterprise teams of 10 or more paid users can have.
Information Security PolicyBackups every 5 to 10 minutes
A full backup every week, a differential every 12 hours and a transaction log backup every 5 to 10 minutes, kept in storage geo-replicated to a paired data centre. After a disaster, data can be restored to within the last 10 minutes.
Data residency on request
Customers who need their data in a particular region, including the EU, can have it hosted there. Backups of EU-hosted data stay in the EU, and EU customers’ transactional email goes through an EU provider.
SubprocessorsBuilt-in redundancy
The service has redundancy to withstand failures and is monitored constantly. Security updates are applied on a regular basis under controlled change management.
Payment details never reach us
Paddle, CheckFlow’s merchant of record, takes and stores card details. CheckFlow only knows whether a payment has been made.
Sign-in
Sign-in methods and single sign-on
People sign in with a Google or Microsoft account, through your own identity provider, or with an email address and password. Email sign-ups confirm their address with a token link, and people on email and password can turn on two-factor authentication with an authenticator app. Administrators choose the methods that suit the organisation.
Single sign-on is part of Enterprise ($18 per user per month ($16.20 billed annually) with a minimum of 5 users). It supports Azure AD, Google Workspace, Okta, Microsoft ADFS and other SAML providers, creates accounts the first time someone signs in, and runs on your own subdomain, such as yourcompany.checkflow.io. Removing someone in your identity provider does not deactivate them in CheckFlow, so do both when someone leaves.
- Two-factor authentication is included in the Business plan
- Your identity provider can pass a role and a time zone for new accounts
- Teams are invitation-only: nobody joins without an Administrator
Access control
Who can see and do what
Every person has one role. Administrators have full access. Members get named permissions, such as creating templates, running checklists, seeing analytics or using AI features, and an Administrator can take any of them away. Guests are limited to their own dashboard and the tasks assigned to them, cannot be given permissions and cannot see the activity feed.
On top of roles, template permissions decide who can run and view each process, Library folder permissions decide who can view or edit each folder, and a task can be set so that only its assignees can complete it. When someone leaves, marking them inactive removes their access at once while keeping everything they did, still in their name.
- Analytics is limited to Administrators and Members with Analytics.Viewer
- An API key acts as one member and can never reach further than they can
- Other Administrators are notified when someone is marked inactive or loses AI access
Audit trail
An audit trail on every checklist
Each checklist records its own history as people work: who completed or uncompleted a task, who marked it not applicable, every value entered in a field, and every file uploaded or deleted, with a name and a time. There is nothing to set up, and the feed covers standalone tasks attached to the checklist as well.
Templates keep the same kind of record. Every save is a numbered version with who saved it and when, and versions are kept indefinitely. Checklists already running stay on the version they started from, so a finished checklist always shows the process as it was followed.
- Audit log of key actions on Business and Enterprise
- Completed checklists are never changed by later template edits made in the app
- Export reports to CSV, Excel or PDF for an auditor
Practices
Security in how CheckFlow is built and run
- 01
Least-privilege access to customer data
Production systems and customer data are reachable only by authorised staff, for operating, supporting and securing the service. Every employee signs a Data Access Policy, and access follows their role.
- 02
Reviewed, tested changes
Code lives in Azure DevOps. Each change passes automated tests and a manual review, then a staging environment, before production. Sensitive changes get an extra security review.
- 03
Access rules tested automatically
A suite of automated tests checks that access control rules are written correctly and enforced, and every access control change is published to a list.
- 04
Outside testing
CheckFlow works with third-party security professionals who test the code for common exploits and scan the production servers.
- 05
Incidents and breaches
Suspected incidents are investigated promptly, and customers affected by a confirmed breach are told without undue delay.
- 06
Retention and deletion
After an account closes, its data is deleted within 90 days, or sooner on request, including from backups as they rotate. CheckFlow can confirm in writing when it is done.
See the Record Retention and Data Destruction policies.
On the standard service, authorised support staff may open your data to resolve a support request. Customers who need stricter isolation can have a dedicated instance, where staff access can be restricted further.
Privacy
GDPR, contracts and subprocessors
CheckFlow Ltd is established in the United Kingdom and is subject to the UK GDPR. Its GDPR programme covers the EU GDPR as well.
Data processing agreement
Customers who control EU or UK personal data can sign a DPA. Email privacy@checkflow.io with your company name and account; the aim is to reply within five business days.
GDPR commitmentInternational transfers
The European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where it applies, are available on request.
Privacy policySubprocessors, published
Microsoft Azure for hosting, Scaleway or Twilio SendGrid for email, Paddle for payments, Sleekplan for feedback and tawk.to for live chat. A new subprocessor is announced at least 30 days before it starts.
Subprocessor list
By plan
Security features by plan
Most of the above is the same on every plan. These are the differences.
| Feature | Business | Enterprise |
|---|---|---|
| TLS 1.2+, backups, activity feed | Included | Included |
| Two-factor authentication | Included | Included |
| Audit log and template version history | Included | Included |
| Roles, permissions, folder and template permissions | Included | Included |
| SAML single sign-on | No | Included |
| EU or other regional hosting | On request | On request |
| Dedicated database (encryption at rest) | No | Teams of 10 or more paid users |
| Custom email sending domain | No | Included |
Business is $10 per user per month, or $9 billed annually. Enterprise is $18 per user per month ($16.20 billed annually) with a minimum of 5 users. See pricing.
AI, inside the same boundaries.
AI in CheckFlow follows the same rules as everything else: Administrators decide whether it is on, and an assistant can only do what a person could.
Two switches, one tab
Administrators can turn off AI features and AI assistant connections separately, for the whole team, on the AI tab of Team Management.
AI in CheckFlowNot used for training
Generate with AI runs on CheckFlow’s own Azure resource in your region. Microsoft does not use prompts or results to train models, and documents are read, then discarded.
Try the AI generatorAssistants act as a person
Claude, ChatGPT, Gemini, Grok, Copilot or any other AI assistant works through the MCP server with the access of its API key’s member, and its changes are recorded in that member’s name.
Developer overview
Who signed off the Q3 user access review, and when?
checklist: "User Access Review – Q3" sort: "occurredAt:desc"
Priya N. set the decision to Approved and completed Security lead sign-off at 14:12 today. Lena O. uploaded the access export and completed the privileged account review this morning.
Security reviews teams run in CheckFlow.
The same controls, applied to your own processes.
Related pages
Security questions
Where is CheckFlow data hosted?
On Microsoft Azure. Primary hosting is in the United States. Other regions, including the EU, are available for customers who need their data stored in a particular region, and backups of EU-hosted data stay in the EU. Regional hosting is available on both the Business and Enterprise plans.
Is my data encrypted?
Data in transit is encrypted: web connections to CheckFlow use TLS 1.2 and above. Encryption of data at rest is available on dedicated database instances, which Enterprise teams of 10 or more paid users can have. See the Information Security Policy.
How often is data backed up?
A full backup every week, a differential backup every 12 hours and a transaction log backup every 5 to 10 minutes. Backups are stored in blobs geo-replicated to a paired data centre, so after a disaster data can be restored to within the last 10 minutes.
Does CheckFlow support single sign-on and two-factor authentication?
Yes. Two-factor authentication with an authenticator app is available to anyone on email and password sign-in. SAML single sign-on, with Azure AD, Google Workspace, Okta, Microsoft ADFS and other SAML providers, is part of Enterprise ($18 per user per month ($16.20 billed annually) with a minimum of 5 users). Contact us to set it up.
Which security certifications cover CheckFlow?
CheckFlow is hosted on Microsoft Azure, whose data centres are covered by Microsoft’s independently audited SOC 1 and SOC 2 Type 2 reports and its ISO/IEC 27001 certification, for their physical and network security. CheckFlow does not hold a certification of its own. CheckFlow’s own controls are described in its Statement on Security and Information Security Policy. For a security questionnaire, contact us.
Is CheckFlow GDPR compliant?
CheckFlow has a GDPR compliance programme covering the EU GDPR and the UK GDPR. Customers who control EU or UK personal data can sign a data processing agreement and Standard Contractual Clauses by emailing privacy@checkflow.io. See the GDPR commitment and the subprocessor list.
What happens to our data if we leave?
You can export your data during the subscription. After the account closes, customer data is deleted within 90 days, or sooner if you ask, and purged from backups as they rotate. CheckFlow can confirm in writing once deletion is complete.
How do I report a security concern?
Email security@checkflow.io, or use the contact page. You will get a reply within 24 hours.
Run your processes on a platform you can vouch for.
Start a free trial, or talk to us about SSO, data residency and your security review.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting