Security

Where we stand

EasyFlow360 is operated by Mundyal Technology LLC, a Massachusetts limited liability company based in Holden, Massachusetts. This page is what we can show you about how the Service is built and run.

We hold no third-party security certification. We do not claim SOC 2, ISO 27001, or any equivalent, and any sentence in our material that implies one is wrong. What we offer instead is this page, the Data Processing Agreement, and a written answer to your security questionnaire, which we keep pre-filled.

Encryption

All traffic is encrypted in transit with TLS. Our database and our off-site backups are encrypted at rest. Tax identifiers are additionally encrypted at field level with AES-256-GCM, under a key kept separately from the database, so a copy of the database alone does not read them back. Documents and files are stored on access-controlled infrastructure. Passwords are hashed with bcrypt and never stored in readable form.

Access control

• Per-company isolation on every request. Each request is scoped to the company it came from. There is no shared view and no cross-company query.
• Six staff permission tiers plus a separate client role. Staff below the admin tiers see only the clients they are assigned to. Clients see their own workspace and nothing else.
• Optional two-factor authentication. Per-user TOTP with recovery codes and remembered devices, on web, iOS and Android. It is opt-in, so treat it as available rather than enforced.
• One session per user. A second sign-in ends the first, so a forgotten session on a shared machine stops working.
• Tax identifiers are masked by role. Roles that do not work the account see the last four digits only.

Audit trails

Every money path and every signature carries its own trail: payments, reconciliation, invoicing, signing, and sign-in events. Signature records hold a SHA-256 hash of the document as signed, the exact consent text shown, and the signer's IP and device. Platform-administrator actions, including any support access to a company's workspace, are written to a hash-chained log, so a removed or altered entry is detectable rather than invisible.

Hosting, backups and recovery

The Service runs on managed infrastructure with a managed database that supports point-in-time recovery. Backups run nightly to a separate location and are kept for 30 days. Deleted records go to a 30-day trash before they are purged, so an accidental deletion is recoverable without restoring a backup.

Subprocessors

The same list as Privacy Policy section 5 and DPA section 7. Each receives only what the named function needs.

• Stripe: payment processing, payout accounts, and the bank and credit-card connections your users authorize (Stripe Privacy Policy)
• Anthropic: reading the transactions out of statements your users upload, and suggesting a bookkeeping category. A statement is sent in full, so whatever it contains is sent with it. Anthropic does not use data submitted through its API to train its models (Anthropic Privacy Policy)
• Our hosting, database, and backup providers: running the Service and storing your data
• Our email provider: delivering notifications, invoices, and signature requests

We give 30 days' notice before adding a subprocessor that handles customer data, which is a commitment in DPA section 7.

If something goes wrong

We keep a written incident runbook: a named decision owner, a containment order that preserves the audit log as evidence, an inventory of the data categories we hold, and the notification clocks. We notify affected companies within 72 hours of becoming aware of a breach, with what happened, which categories of data were involved, and what we are doing. You remain the controller of your clients' data, so notifying regulators and data subjects is yours to do, and our job is getting you the facts in time for your own deadline.

Report a suspected vulnerability or incident to contact@easyflow360.com, which reaches the person running the response. We have no bug-bounty programme, and we will not threaten anybody who reports a finding in good faith.

Your data, on your terms

• Export: an owner or administrator can download the whole company from Settings at any time, as one archive of JSON records plus every stored file. No request, no waiting.
• Deletion: we delete or anonymize within 90 days of a request, and confirm it in writing. See Delete your account.
• Data subject requests: when one of your clients comes to us, we send them to you, because you are the controller of that record, and we tell you they asked. We help you answer within 10 business days.

What we do not have

This list is here so you can judge the rest of the page. Everything on it is work we have decided against for now or have not reached yet.

• No SOC 2, ISO 27001 or equivalent audit. No third-party certification of any kind.
• No external penetration test. Security review has been internal to date.
• No malware scanning on uploaded files. Uploads are type-checked and size-capped; they are not scanned.
• No enforced two-factor authentication. It is available to every user and switched on per user, and we will not describe it as mandatory.
• No public status page. Incidents are communicated by email to affected companies.
• No cyber insurance and no counsel on retainer. Both are open items rather than oversights.
• Single-region, single-host deployment. Backups are off-site; the serving infrastructure is not redundant across regions.

Language

This page is published in English. A Brazilian Portuguese translation is available at easyflow360.com/pt/security. The translation is there to be read, not to replace this text: where the two differ in meaning, the English version governs.

Ask us

Send a security questionnaire, a DPA to countersign, or a question about any line on this page to contact@easyflow360.com.