Core Security Principles
Neoflo’s security model is built on four pillars that apply across every deployment option and every customer environment.- Encryption everywhere: All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. There are no unencrypted data paths.
- Role-based access control: Access to your data — both for your team and for Neoflo staff — is governed by least-privilege roles. No one sees more than they need to.
- Complete audit logging: Every action taken on your data is recorded in a tamper-evident audit trail. You can review, export, and reference logs at any time.
- Regular penetration testing: Neoflo engages independent security firms to conduct penetration tests on a regular cadence, validating our controls against real-world attack scenarios.
Deployment Options
Neoflo offers two deployment models to match your organisation’s data residency, compliance, and infrastructure requirements.Managed Cloud
Neoflo’s managed cloud is a hosted, multi-tenant environment operated by Neoflo. Your data is logically isolated from other customers using strict tenancy controls. The environment is SOC 2 Type II certified, continuously monitored, and maintained by Neoflo’s security team — so you get enterprise-grade protection without managing infrastructure yourself.Customer VPC
For organisations with stricter data residency or sovereignty requirements, Neoflo can deploy entirely within your own cloud environment — AWS, GCP, or Azure. In this single-tenant configuration, your data never leaves your infrastructure. You retain full control over networking, access policies, and data boundaries, while Neoflo’s agents and automation layer run inside your perimeter.For customers with strict data residency or sovereignty requirements, the Customer VPC deployment option is recommended. Your data never leaves your cloud environment, giving you complete control over where it lives and who can access it.
Key Security Features
256-bit Encryption
AES-256 encryption protects all data at rest. TLS 1.2+ secures all data in transit across every connection, including ERP integrations and API calls.
SOC 2 Type II
Neoflo is SOC 2 Type II certified, covering security, availability, and confidentiality controls — audited annually by an independent third party.
ISO 27001
Our information security management system is ISO 27001 certified, meeting the international standard for risk assessment, controls, and continuous improvement.
Complete Audit Trail
Every action taken on your data is captured in a full audit trail. Logs are tamper-evident, exportable, and available for your compliance and governance reviews.
Role-Based Access Control
Granular roles let you control exactly who on your team can view dashboards, access reports, and manage integrations — with no more access than necessary.
Regular Penetration Testing
Independent security firms test Neoflo’s infrastructure and application layer regularly, identifying and remediating vulnerabilities before they become risks.
Learn More
Dive deeper into how Neoflo handles your data and the certifications we maintain:- Data Handling and Privacy — how Neoflo ingests, processes, stores, and deletes your data
- Compliance Certifications — SOC 2 Type II, ISO 27001, GDPR, and CCPA details