Start free
Security

The key is never
next to the lock.

Flowplane is a Belgian company that hosts in EU data centres only. Your credentials sit in our database as ciphertext, the key that opens them sits in a key service we cannot copy, and the hardware that unlocks that key sits in the EU.

See the roadmap →Subprocessors
EU only
A Belgian company in EU data centres. Data and logs never leave the Union.
We can’t read your credentials
Sealed per workspace. Only the gateway opens one, for one call.
Logs without content
Who, what, when and the decision. Never message text or documents.
Your rights, never more
Agents work as the person behind them. Risky actions wait for approval.
How it’s protected

Built so we can’t look inside.

Sealed credentials

Every password, key and token is sealed under your workspace’s own key. We can store it, never read it back.

Facts, never content

Every call is recorded: who, which tool, the decision. Message text and documents stay out, and the log is tamper-evident.

Only ever narrows

An agent has the rights of the person behind it, never more. “Ask first” holds the call until they approve. A block always wins.

One door to the outside

Only the gateway talks to your apps, over TLS, to the address you connected. No private addresses, no redirects.

Backups, in the EU

Copied nightly to a second EU location, encrypted first, kept 30 days. A restore is rehearsed every quarter.

Also built in

Your browser holds no token
The console keeps sign-in tokens on the server behind a session cookie no script can read, with a strict content policy and no framing. Admins and owners need a passkey or an authenticator app on top of your company sign-in.
Everything inside is encrypted too
TLS on every hop between our own services, secrets encrypted at rest, keys rotated on a schedule, and every action on a key or a master credential raises an alert.
Reviewed with you
We walk customers through the security design behind these rules, under NDA.
Where your data runs

In the EU, with no US vendor added to your path.

Every provider that processes personal data for Flowplane and flowplane.eu.

  • Faastic and DNS53

    Belgium

    Faastic provides and maintains the servers Flowplane and this website run on; DNS53 provides their network and rack space in a Belgian data centre.

  • OVHcloud

    France

    Key management that protects the master keys of our key service. Key material only, never your data.

  • Hetzner

    Germany and Finland

    Our encrypted backups, and the mail server we run ourselves.

  • Plausible

    Our own servers

    Visitor statistics on our own servers, with no outside analytics provider.

See all subprocessors →

Roadmap

The controls we ask of you, we pass first.

This is where we stand.

  1. In place

    GDPR processor agreement

    Part of our terms, accepted with every workspace. EU staff, EU infrastructure and a subprocessor list you can read in one minute.

  2. In progress

    CyberFundamentals Important

    The Belgian conformity path for NIS2: MFA everywhere, least privilege, segmented management, tested backups and an incident procedure. Complete before we invoice the first customer.

  3. Planned

    ISO 27001

    Starts when the first healthcare or public-sector customer is in sight. Same controls, international certificate.

Scope: an access layer and nothing else, with no CDN and no chat product. Small enough to certify and to explain to an auditor in one meeting.

Compared

How it is secured, side by side.

US zero trust vendorsSelf-hosted MCP gatewaysFlowplane
Can the vendor read your credentials?Mostly not statedAnyone with database accessNo, write-only custody
What unlocks the key serviceNot stated, or an add-onYour env var or cloud KMSAn EU HSM, at start only
Tool arguments in the audit logVaries, often storedLogged, often by defaultNever, a keyed fingerprint
Tamper-evident log, reads loggedNot publishedRarely, admin events onlySigned checkpoints, access logged
Approval bound to the exact callOne vendor, wired by youRules, no call-bound gateSigned, per call, in the gateway
Backups and a restore drillRarely publishedYour jobEncrypted, in the EU, drilled quarterly
Data and logs stay in the EUUS parent, US subprocessorsWherever you host itBelgian company, EU only
CertifiedSOC 2, ISO 27001Often SOC 2Not yet, CyberFundamentals in progress

Read the details

SubprocessorsEvery provider that processes personal data for us, and where the data is.Privacy noticeWhat the site and the service collect, why, how long we keep it and your rights.TermsThe terms, the processor agreement and our security measures.NIS2 checklist15 points that map zero trust practices to CyberFundamentals controls.

Let your AI work with your data. Safely, from today.

Free for yourself, set up in a minute. For your team or company, we’re happy to help you get started.

Start free →Book a call