Trust Center

Autoflows A/S provides Software-as-a-Service for automotive dealerships and workshop organisations. The platform covers aftersales automation, customer retention and re-engagement workflows, workshop booking, and CRM and customer communication across voice, SMS, email and WhatsApp.

This Trust Center sets out how Autoflows protects the data its customers entrust to it. It is intended to answer the questions a security or privacy reviewer would otherwise raise in a questionnaire, and to answer them accurately.

Independent assurance

Autoflows holds two Type I reports, both issued by Securance Assurance Ltd and both examining the design of controls as at 26 November 2025: a SOC 2 Type I against the Trust Services Criteria relevant to Security and Privacy, and an ISAE 3000 Type I against the same criteria, with control objectives covering data collection and consent, technical measures, governance and policy management, deletion of personal data including data subject rights requests, and the use of sub-processors.

Both reports carry a qualified opinion. The auditor's findings and the exceptions are set out in the reports themselves, which are subject to the auditor's restriction on use and distribution and are released only through this Trust Center following acceptance of the Autoflows non-disclosure agreement. Type II examinations against both standards are in progress.

Encryption

Data in transit is encrypted across all Autoflows systems and transfers. Public-facing endpoints enforce TLS 1.2 or higher with HTTP Strict Transport Security and certificate validation, administrative access uses SSH, and legacy authentication protocols are blocked.

Encryption at rest is applied to company endpoints, which use whole-disk encryption, and to backups and application objects held in cloud object storage, which use provider-managed encryption.

Production database and volume storage operates without encryption at rest at the storage layer, because encryption at that layer materially degrades platform performance. Autoflows records this as an accepted risk, formally approved by the Chief Technology Officer and reviewed at least annually. The compensating controls are access limited to personnel whose role requires it, encryption in transit, encrypted backups with restore testing in the annual disaster recovery exercise, multi-factor authentication on the accounts used for corporate access with legacy authentication blocked, host-based logging, and the ISO/IEC 27001:2022 certification held by Hetzner, which hosts Autoflows infrastructure in Germany. Backups are held with Google Cloud in the European Union. The full sub-processor list, with the location and transfer mechanism for each, is published under Legal.

Security testing

Autoflows commissions an independent third-party penetration test annually, performed against the OWASP Web Security Testing Guide. The most recent test was carried out in March 2026 against the standby and staging environment rather than production.

Testing runs on an annual rotation, and extending the scope to production is under consideration for the next engagement.

The full report contains reproduction detail for every observation and is therefore not distributed. The scope, methodology, findings by severity and remediation status can be discussed on request, and questions can be directed to privacy@autoflows.com.

Governance

Autoflows maintains a documented policy set covering information security, data protection, access control, encryption, incident response, business continuity and vendor management, each with a named owner and subject to at least annual review, with a material policy version approved by an officer other than the document owner. A Data Protection Officer is appointed. Security incidents are reported to incidents@autoflows.com and handled under the Incident Response Plan.

Requesting documents

Policies, procedures and the assurance reports listed in this Trust Center are released on request, following acceptance of the Autoflows non-disclosure agreement. Requests and questions can be directed to privacy@autoflows.com.