Blog

Real setups, and how to do it safely.

How people, teams and companies give their AI access to their data. Written by the people who did it, and by us.

Latest29 September 2026Guide8 min readMCP security: giving AI agents access to company systems without sharing tokensWhat the MCP spec says about OAuth, audience binding and token passthrough, and a gateway pattern that gives AI agents per-person access with a full audit log.FFlowplane, guideRead the post →

29 September 2026NIS2 and zero trust: a practical checklist for Belgian SMEsWho falls under Belgium's NIS2 law, the CyFun and ISO 27001 deadlines, and a 15-point checklist mapping zero trust practices to CyberFundamentals controls.Guide9 min
29 September 2026European alternatives to Cloudflare Zero Trust and Zscaler: what to look atWhy EU firms look past US ZTNA providers (CLOUD Act, FISA 702, NIS2), what to check in a vendor, and a verified look at NetBird, GoodAccess, Enclave and more.Guide9 min
14 September 2026An open RDP port, a Copilot with a service account, and an auditor with two questions.Acme NV runs an ERP on a Windows server and 340 people on Microsoft 365. The NIS2 audit asked who can reach the ERP and which AI has access to what. This is how those two questions got a CSV for an answer.Company6 min
9 September 2026How Gigflow put its support agents, its staging database and its memory behind one gate.We are nine people. We had a VPN, a shared admin login and three agents with more rights than any of us. Six weeks later we run all four Flowplane products and the log is the first thing I open.Team7 min
2 September 2026I only wanted one URL for my agents. The tunnel came free.Claude, Cursor and ChatGPT each had their own pile of tokens to my Postgres, my GitHub and a box under my desk. Now they share one MCP endpoint, and the box never opened a port.Personal5 min