Trust & security

How JetFlow looks after your company's data

This page lists the controls that exist in JetFlow today, how we build and release it, and where it stands on certification. If something is not on this page, please do not assume we do it — ask us.

Last reviewed 28 September 2026

Security controls in the product

Encryption of stored secrets

AI provider keys, connector sign-in tokens and credentials, and Companies Registry e-filing credentials are encrypted at rest with AES-256-GCM under a dedicated field-encryption key. Full identity-card and bank account numbers are kept in exactly two places, each encrypted field by field with AES-256-GCM and decrypted only to produce the form or file that needs it, or when an authorised user downloads that file: an employee's IR56 tax profile (for the IR56 forms) and the payment details of a supplier or of your own bank account (for bank payment files). Screens show them masked. Everywhere else — employee, supplier, bank-account and officer records — JetFlow keeps only the last four characters.

Encryption in transit

Every page and every API call is served over TLS.

Tenant isolation

Each company's records are kept apart. Every query the application makes is scoped to the company you are signed in to, and automated tests check that one company cannot read another company's records or files.

Append-only audit log

Changes are written to an audit log, and database triggers reject any update or deletion of an audit entry, so the log can only grow. A separate read log records who opened the most sensitive records, such as staff files, payroll and bank details.

Role-based access

Eleven roles — from owner and business admin to finance, HR, sales, project manager and read-only viewer — decide which modules and actions each person can use. An external accountant gets a service-provider role limited to the modules you choose, and that access expires.

Sign-in

Passwords are stored only as argon2id hashes. A signed-in session is re-checked against the account's role and status every minute, so a suspended user loses access promptly.

Personal data (PDPO) tools

Consent to the privacy terms, to marketing and to cookies is recorded separately, and marketing consent can be withdrawn at any time. Data-access and export requests are made in the product and tracked in a staff queue. A scheduled job deletes data when its retention period ends — for example, AI inputs and outputs after 30 days.

Multi-factor authentication

Two-step sign-in with an authenticator app is available to every user. It is required for JetFlow platform staff, and each company can require it for all of its members.

How we build it

Automated tests

More than 900 test files, holding thousands of automated tests, run before a release is promoted. Bugs we fix get a test that fails without the fix, and each one is recorded in our bug ledger.

Tested claims

What we say publicly is tested too: an automated check fails the build if this site or our documentation describes a feature that is not built, in any of our three languages.

How releases work

Every change runs first on a development environment. A version is then built once, as a single image. That same image goes to our acceptance environment, where it is tested, and is later promoted to production unchanged — production is never a separate build. Promotion to acceptance and to production each needs the owner's explicit approval.

01
Development
02
One versioned image
03
Acceptance testing
04
Production

Certifications

JetFlow has no SOC 2 report and no ISO 27001 certificate. A SOC 2 readiness programme is in progress; we will update this page when an independent audit has been completed, and not before.

Members of our team hold CISA and CISM credentials. Those are individual professional qualifications, not a certification of JetFlow.

Where your data is

JetFlow runs on a virtual private server from Hostinger International, behind Cloudflare. The application, its database and your uploaded files are on that server.

AI features send the text of a request to OpenRouter and to the model provider it routes to, which may be outside Hong Kong. Every processor and its region is listed in our Privacy Policy.

We do not publish an uptime figure, because we do not yet measure one independently.

Report a security issue

If you find a vulnerability, email us. We reply within two working days. Please give us reasonable time to fix an issue before you make it public, and do not access or change data that is not yours while you test.

[email protected]