Security &
Governance.

All production data is hosted within EU/EEA data centres. No customer data is stored or processed outside the European Economic Area unless explicitly agreed in writing.

Yes. A GDPR-compliant DPA is provided as standard with all customer contracts. It covers processing purposes, subprocessor obligations, data subject rights, and breach notification procedures.

A current list of subprocessors is maintained and shared with customers. Changes to the subprocessor list are communicated in advance per the terms of the DPA, giving customers the opportunity to review and, where applicable, object.

The ISO/IEC 27001 certification covers the information security management system governing platform infrastructure, application development, and operational processes. The Statement of Applicability is available under NDA on request.

CompetenceFlow enforces RBAC at the organisation, department, and function level. Permissions follow the principle of least privilege. Administrators can define and manage roles through the platform's governance interface.

Audit logs record administrative actions, authentication events (login, logout, failed attempts), permission changes, and data modifications. Logs are immutable and exportable in standard formats for external compliance review.

Data export and deletion requests are processed in accordance with GDPR data subject rights. Customers can initiate exports via the platform or through support channels. Erasure requests are fulfilled within documented SLA timelines.

You are free to leave at any time with all your data. CompetenceFlow is EU Data Act compliant with no unreasonable contract lock-in periods. We provide full data export in standard, portable formats and will actively assist with transitioning to another provider — including a competitor. We keep customers by delivering value, not by trapping them.

CompetenceFlow follows a documented incident response process. In the event of a personal data breach, affected customers are notified without undue delay and within the timeframes specified in the DPA, in accordance with GDPR Article 33 obligations.

SSO and SAML-based authentication are available on enterprise plans and by request. Contact your account representative or the sales team to discuss identity provider integration for your organisation.

Submit your security questionnaire or vendor assessment form to your account representative or via the demo request form. Standard questionnaire responses are returned within an agreed turnaround time during the procurement process.