Security

Flaree runs on Amazon Web Services in the eu-central-1 region, Frankfurt, Germany. Application servers, the production database and its backups are all in that region. Some sub-processors, such as OpenAI and Google, process data outside the EU. The sub-processors list names each one, and the DPA states the transfer mechanism for each.

Flaree is operated by Mobile Reality sp. z o.o., registered in Warsaw, Poland. The GDPR is domestic law for us. Where a sub-processor processes data outside the EU, we rely on a transfer mechanism under Chapter V of the GDPR: the EU-U.S. Data Privacy Framework or Standard Contractual Clauses.

Data at rest is encrypted with AES-256. Data in transit is encrypted with TLS 1.2 or higher — the load balancer and the CDN both reject earlier versions.

Each account carries a role, and each role carries an explicit set of permissions. A user reaches only their own company's data, and only the parts their role allows. Company administrators assign and revoke roles from the dashboard.

The production database is backed up daily, in the same region. Backups are retained for 30 days and then deleted.

We name every third party that processes data on our behalf, and what each one handles.

Download the Data Processing Agreement (DPA) that covers how Mobile Reality sp. z o.o. processes personal data for you under Article 28 of the GDPR. It is part of the Terms of Service and takes effect when you accept them.

Your data is kept while your account is open. Administrators export their employee data from the dashboard at any time, and can request a full machine-readable export by email. When you ask us to delete an account, we remove it from the production database, and the last backup copy expires 30 days later.

Report a vulnerability to security@flaree.app. Include the steps to reproduce it and the account or URL affected. The same contact details are published in machine-readable form.