Control Who Can
See and Change Data.

All production data is hosted within EU/EEA data centres. No customer data is stored or processed outside the European Economic Area unless explicitly agreed in writing.

Yes. A GDPR-compliant DPA is provided as standard with all customer contracts. It covers processing purposes, subprocessor obligations, data subject rights, and breach notification procedures.

A current list of subprocessors is maintained and shared with customers. Changes to the subprocessor list are communicated in advance per the terms of the DPA, giving customers the opportunity to review and, where applicable, object.

The ISO/IEC 27001 certification covers the information security management system across platform infrastructure, application development, and day-to-day operations. The Statement of Applicability is available under NDA on request.

CompetenceFlow sets access by role at the organisation, department, and function level. Each role gets only the permissions it needs. Administrators define and manage roles in the platform's admin settings.

Audit logs record administrative actions, authentication events (login, logout, failed attempts), permission changes, and data modifications. Logs are immutable and exportable in standard formats for external compliance review.

Data export and deletion requests are processed in accordance with GDPR data subject rights. Customers can initiate exports via the platform or through support channels. Erasure requests are fulfilled within documented SLA timelines.

You can leave at any time with all your data. CompetenceFlow is EU Data Act compliant, with no unreasonable lock-in periods. You can export everything in standard, portable formats, and we will help you move to another provider, even a competitor. We keep customers by being worth it, not by trapping them.

CompetenceFlow follows a documented incident response process. In the event of a personal data breach, affected customers are notified without undue delay and within the timeframes specified in the DPA, in accordance with GDPR Article 33 obligations.

SSO and SAML-based authentication are available on enterprise plans and by request. Contact your account representative or the sales team to discuss identity provider integration for your organisation.

Submit your security questionnaire or vendor assessment form to your account representative or via the demo request form. Standard answers are returned within an agreed turnaround time.