Funnelflow

Appearance

Data Storage & Location ​

Understanding where your data is stored and how it's protected is crucial for GDPR compliance and maintaining customer trust. SmartFlow provides transparent data storage practices with multiple geographic options to meet your compliance requirements.

🌍 Global Data Centers ​

Primary Storage Locations ​

European Union (EU) ​

Amsterdam, Netherlands - Primary EU data center

  • Certifications: ISO 27001, SOC 2 Type II
  • Compliance: Full GDPR compliance, Dutch data protection laws
  • Infrastructure: Tier III+ facility with 99.99% uptime SLA
  • Security: 24/7 physical security, biometric access controls

Frankfurt, Germany - Secondary EU location

  • Purpose: Backup, disaster recovery, load balancing
  • Certifications: ISO 27001, BSI IT-Grundschutz
  • Features: Geographic redundancy, automated failover
  • Compliance: German Federal Data Protection Act (BDSG)

United States ​

Virginia, USA - Primary US data center

  • Certifications: SOC 2 Type II, FedRAMP Moderate
  • Compliance: CCPA, state privacy regulations
  • Infrastructure: AWS US-East region, multiple availability zones
  • Security: AWS shared responsibility model, enhanced monitoring

Oregon, USA - Secondary US location

  • Purpose: West coast presence, disaster recovery
  • Features: Renewable energy powered, carbon neutral
  • Compliance: California Consumer Privacy Act (CCPA)

Data Residency Options ​

EU-Only Storage ​

For maximum GDPR compliance:

  • Data Location: All data stored within EU boundaries
  • Processing: No data transfer outside EU/EEA
  • Backups: EU-only backup locations
  • Support: EU-based support staff access only
  • Certification: Regular GDPR compliance audits

Multi-Region Storage ​

For global performance optimization:

  • Primary Region: Your chosen home region
  • Cross-Region Backups: Encrypted backups in secondary regions
  • Transfer Mechanisms: Standard Contractual Clauses (SCCs)
  • Data Sovereignty: Primary data remains in chosen region

🏗️ Infrastructure Architecture ​

Database Storage ​

Production Databases ​

  • Technology: PostgreSQL with encryption at rest
  • Replication: Real-time synchronous replication
  • Backup Frequency: Continuous point-in-time recovery
  • Retention: 30-day backup retention, 7-year archival
  • Encryption: AES-256 encryption with managed keys

Data Warehouse ​

  • Purpose: Analytics, reporting, long-term storage
  • Technology: Columnar storage optimized for queries
  • Data Processing: ETL processes with privacy controls
  • Access Controls: Role-based access, audit logging
  • Anonymization: Automated PII removal for analytics

File Storage ​

Form Attachments ​

  • Storage Type: Object storage with versioning
  • Encryption: Client-side encryption before upload
  • Access Controls: Pre-signed URLs with expiration
  • Virus Scanning: Automated malware detection
  • Retention: Configurable retention policies

System Logs ​

  • Log Types: Application, security, audit logs
  • Retention: 90 days active, 2 years archived
  • Access: Restricted to security and operations teams
  • Encryption: Encrypted in transit and at rest
  • Monitoring: Real-time log analysis and alerting

🔐 Security Measures ​

Encryption Standards ​

Data at Rest ​

  • Algorithm: AES-256 encryption
  • Key Management: Hardware Security Module (HSM)
  • Key Rotation: Annual automatic rotation
  • Access Controls: Multi-person authorization required
  • Compliance: FIPS 140-2 Level 3 certified

Data in Transit ​

  • Protocol: TLS 1.3 for all connections
  • Certificate Management: Automated certificate renewal
  • API Security: OAuth 2.0 with JWT tokens
  • VPN Access: Site-to-site VPN for integrations
  • Perfect Forward Secrecy: Ephemeral key exchange

Access Controls ​

Physical Security ​

  • Data Centers: Tier III+ certified facilities
  • Access Control: Biometric authentication, mantrap entries
  • Surveillance: 24/7 video monitoring and recording
  • Personnel: Background-checked, trained staff
  • Compliance: Regular security audits and assessments

Logical Security ​

  • Authentication: Multi-factor authentication required
  • Authorization: Role-based access control (RBAC)
  • Monitoring: Continuous access monitoring and logging
  • Alerts: Real-time security incident detection
  • Reviews: Quarterly access reviews and updates

🌐 Cross-Border Data Transfers ​

Standard Contractual Clauses (SCCs) ​

  • Version: EU Commission approved SCCs (2021)
  • Application: All international data transfers
  • Safeguards: Technical and organizational measures
  • Monitoring: Regular compliance assessments
  • Updates: Automatic updates for regulatory changes

Adequacy Decisions ​

SmartFlow leverages EU adequacy decisions for:

  • United Kingdom: Post-Brexit adequacy decision
  • Switzerland: Ongoing adequacy recognition
  • Future Locations: Monitor new adequacy decisions

Transfer Impact Assessments ​

Risk Analysis ​

Before any international transfer:

  • Legal Framework Assessment: Analysis of destination country laws
  • Technical Safeguards Review: Encryption and access controls
  • Organizational Measures: Policies and procedures evaluation
  • Risk Mitigation: Additional safeguards implementation
  • Documentation: Comprehensive impact assessment records

Monitoring and Review ​

  • Quarterly Reviews: Assessment of transfer risks
  • Legal Updates: Monitoring of regulatory changes
  • Technical Updates: Enhancement of security measures
  • Incident Response: Procedures for law enforcement requests

📊 Data Retention Policies ​

Retention Schedules ​

Customer Data ​

  • Active Accounts: Data retained while account is active
  • Inactive Accounts: 2-year retention after last activity
  • Deleted Accounts: 90-day recovery period, then permanent deletion
  • Legal Holds: Extended retention for legal requirements
  • Backups: 30-day backup retention, secure deletion thereafter

System Logs ​

  • Security Logs: 2-year retention for incident investigation
  • Application Logs: 90-day retention for troubleshooting
  • Audit Logs: 7-year retention for compliance requirements
  • Performance Logs: 30-day retention for optimization
  • Access Logs: 1-year retention for security analysis

Deletion Procedures ​

Secure Deletion ​

  • Data Overwriting: Multi-pass overwriting of storage
  • Cryptographic Erasure: Destruction of encryption keys
  • Physical Destruction: Secure destruction of decommissioned hardware
  • Verification: Certificate of destruction provided
  • Documentation: Comprehensive deletion audit trails

Automated Deletion ​

  • Scheduled Deletion: Automated retention policy enforcement
  • User-Triggered: Immediate deletion upon user request
  • Account Closure: Systematic data removal process
  • Compliance Triggers: Automatic deletion for regulatory compliance
  • Monitoring: Real-time deletion process monitoring

🔍 Transparency and Reporting ​

Data Location Reporting ​

Customer Dashboard ​

Real-time visibility into data storage:

  • Primary Storage Location: Current data center location
  • Backup Locations: Secondary storage sites
  • Transfer Logs: History of any data movements
  • Compliance Status: Current regulatory compliance status
  • Configuration Options: Available storage preferences

Regular Reports ​

  • Monthly Reports: Data location and transfer summaries
  • Quarterly Reviews: Compliance status and any changes
  • Annual Audits: Comprehensive security and location audits
  • Incident Reports: Any security or compliance incidents
  • Regulatory Updates: Changes in data protection laws

Compliance Documentation ​

Certifications ​

Available documentation:

  • SOC 2 Type II Reports: Annual security operation audits
  • ISO 27001 Certificates: Information security management
  • Data Center Certifications: Physical security and operations
  • Penetration Test Results: Regular security assessments
  • Compliance Attestations: GDPR and other regulatory compliance

Audit Support ​

Support for customer audits:

  • Documentation Access: Relevant compliance documents
  • Questionnaire Responses: Security and privacy questionnaires
  • Site Visits: Arranged visits to data center facilities
  • Expert Consultation: Access to security and compliance experts
  • Custom Reports: Tailored compliance reporting

⚙️ Configuration Options ​

Storage Preferences ​

Regional Selection ​

Configure your storage requirements:

  1. Access Account Settings → Data & Privacy
  2. Select Primary Region → Choose from available locations
  3. Configure Backups → Set backup location preferences
  4. Review Transfers → Understand any cross-border implications
  5. Save Configuration → Apply settings to your account

Migration Support ​

Changing storage locations:

  • Migration Planning: Assessment of migration requirements
  • Data Transfer: Secure transfer to new location
  • Validation: Verification of successful migration
  • Old Data Removal: Secure deletion from previous location
  • Documentation: Complete migration audit trail

Compliance Settings ​

GDPR Configuration ​

  • EU-Only Processing: Restrict processing to EU locations
  • Consent Management: Configure consent collection and storage
  • Data Subject Rights: Enable automated rights fulfillment
  • Breach Notification: Configure notification preferences
  • DPO Integration: Connect with your Data Protection Officer

Additional Regulations ​

  • CCPA Compliance: California Consumer Privacy Act settings
  • PIPEDA Compliance: Canadian privacy law compliance
  • Industry Standards: Healthcare, financial services compliance
  • Custom Requirements: Tailored compliance configurations

🚀 Getting Started ​

Setup Checklist ​

  • [ ] Determine your data residency requirements
  • [ ] Review applicable regulations and compliance needs
  • [ ] Configure storage location preferences
  • [ ] Set up appropriate data retention policies
  • [ ] Enable compliance monitoring and reporting
  • [ ] Document decisions for audit purposes

Ongoing Management ​

  • [ ] Regular review of storage configurations
  • [ ] Monitor compliance status and requirements
  • [ ] Update settings for regulatory changes
  • [ ] Maintain documentation for audits
  • [ ] Review and update retention policies

Configure Storage Settings → | Download Compliance Reports →

Funnelflow Documentation

Copyright © 2024 Funnelflow