Secure by design
Enforce single sign-on and role-based access, require approval for sensitive actions, and keep your data out of model training.
Enterprise security controls
Access and control
Roles
Approvals before action
Building, approving, and publishing are separate permissions. Payments, bulk messages, and deletions wait for a named approver.
Credentials handled securely
Connected app credentials are encrypted at rest, limited by role, and never shown in plain text in logs or the interface.
Your data is not used for training
We do not train models on your data, and our model providers are contractually prohibited from doing so.
Isolation by design
Each workspace is logically separated. Customer data is never accessible across accounts.
Encryption everywhere
TLS 1.2 or higher in transit, AES-256 at rest, and encrypted backups.
Every action on record
Employee activity and admin changes are logged with who triggered them, and owners can export the log.
Compliance and data handling
How we handle your data, from access to deletion.
Fless is not HIPAA, PCI, or ISO 27001 certified unless your order form states otherwise. Do not store card numbers or health records in Fless without a signed addendum.
- SOC 2
- Audit in progress with an independent CPA firm.
- Deletion
- Data is deleted within 30 days, and from backups within about 90 days.
- Staff access
- Protected by SSO, MFA, and time-limited roles. All access is logged and reviewed.
- DPA and SCCs
- Available for your security and legal review.
- Incident response
- Owners are notified without undue delay, within legal deadlines.
- Subprocessors
- The full list is available under NDA for your review.
Found a vulnerability?
Email us the steps to reproduce it. Please do not access other customers' data.
security@getfless.comSecurity review
Security questionnaires, our DPA, and the subprocessor list are available under NDA.