Data Encryption
All data is encrypted in transit (TLS 1.2+) and at rest using AES-256-GCM. Application secrets use dedicated encryption keys; KMS envelope encryption is available when configured.
Legal
Security & Compliance
SOC 2 Type II, GDPR, and CCPA compliance as baseline. We are committed to maintaining the highest standards of security, availability, and confidentiality across our platform and operations. See the Delve Trust Center for current status.
Our Security Practices
Access Control & MFA
Role-based access control with mandatory multi-factor authentication for privileged and admin accounts, so elevated access requires stronger verification.
Vulnerability Management
We use dependency scanning and Dependabot in CI, and include independent penetration testing as part of our SOC readiness program.
Vendor Due Diligence
Third-party providers are reviewed for compliance certifications and security posture before integration.
Uptime & Backups
Redundant infrastructure, 24/7 uptime monitoring, and automated backups maintain reliability and business continuity.
Privacy & Confidentiality
Privacy-by-design principles ensure personal and customer data is handled ethically and lawfully.
SOC 2 Trust Principles
These five principles define the foundation of Oflo's approach to trust, transparency, and data protection.
Security
Controls protect against unauthorized access, disclosure, or damage to information and systems.
Availability
Systems are available for operation and use as committed or agreed, supported by redundant infrastructure.
Confidentiality
Information designated as confidential is protected from unauthorized access and disclosure.
Processing Integrity
System processing is complete, valid, accurate, timely, and authorized.
Privacy
Personal information is collected, used, retained, disclosed, and disposed of appropriately.
Infrastructure & Cloud Partners
Our platform is built on secure and reliable cloud infrastructure providers such as AWS and Google Cloud Platform, both of which maintain SOC 2, ISO 27001, and other compliance certifications.
Third-Party Services & Subprocessors
We work with trusted third-party service providers to deliver our platform. For a complete list of all third-party services and subprocessors that process customer data, please see our Third-Party Services & Subprocessors page.
Report a Security Concern
We take security reports seriously. If you believe you've discovered a vulnerability or security issue, please contact our team at support@oflo.ai.
Last updated: September 2026