Security at FluidGrids
We take the security of our platform and your data seriously.
Our commitment to security
FluidGrids is committed to maintaining the highest standards of security to protect our users and their data. Security is designed into the platform from the ground up — from how credentials are stored to how workflow executions are isolated. Our infrastructure is designed for resilience and to safeguard against unauthorized access.
Encrypted credentials
Connection credentials and secrets are encrypted at rest with AES-256 and never exposed in workflow logs or exports.
Role-based access control
Granular RBAC governs who can view, edit, execute, and publish workflows, nodes, and credentials across your organization.
Audit logging
Platform actions are captured in audit logs so administrators can trace changes and access across teams and environments.
Enterprise controls
SSO/SAML and advanced governance controls are part of our enterprise offering. Every API operation is authorised at the gateway against your workspace roles.
Hosted in India on AWS
Customer data is stored in the AWS Mumbai region (ap-south-1). Databases, cache and backups are encrypted at rest, and all traffic is encrypted in transit with TLS 1.2 or higher.
Compliance status
Here is where we stand today, stated plainly. When a report or certificate is issued, we will name it here together with the auditor and the period it covers.
SOC 2 Type II
Not yet heldWe have completed a readiness assessment against the SOC 2 Trust Services Criteria. No SOC 2 report has been issued yet.
ISO/IEC 27001
Not yet certifiedOur information security management system is being prepared for certification. No certificate has been issued yet.
GDPR and India DPDP Act
Processor terms publishedWe act as your processor under a published Data Processing Addendum, with a public subprocessor list and data stored in India by default.
HIPAA
Not offeredFluidGrids does not sign Business Associate Agreements today. Please do not use FluidGrids to process protected health information.
PCI DSS
Out of scopeCard payments are handled by Stripe and Razorpay. Card data never reaches FluidGrids systems.
Our infrastructure runs on AWS, whose data centres are covered by AWS's own SOC 2 and ISO 27001 reports. Those certifications belong to AWS, not to FluidGrids.
Reporting a vulnerability
We value the work of security researchers and the community in helping us maintain a secure platform. If you believe you have discovered a security vulnerability in FluidGrids, please report it to us responsibly.
Please email us at [email protected] with a detailed description of the vulnerability, including:
- A clear description of the vulnerability and its potential impact.
- Steps to reproduce the vulnerability.
- Any relevant screenshots, code snippets, or logs.
- Your contact information.
We will make every effort to acknowledge your report promptly, investigate the issue, and take appropriate action. We appreciate your help in keeping FluidGrids secure.
Questions about security?
Our team is happy to walk through our security practices and enterprise controls.
Contact us