How Floxoft isolates, encrypts, and protects your business records every second of the day.
All client business registers, automatic database logs, transactional messages, and worker KPI metrics are strictly isolated via database tenant IDs. Floxoft staff can only access logs during system downtime or priority client-approved technical support.
All transactional datastores, WhatsApp messaging pipelines, and biometrics templates are fully encrypted in transit using TLS 1.3 protocols and at-rest via secure AES-256 isolated volume segments.
Your data is secure against hardware failures. Databases are replicated continuously with off-site recovery points captured daily, fully encrypted, and distributed across multiple availability zones with 99.999% durability.
Workspace owners can request an on-demand encrypted ZIP export from the company Security tab. The archive includes tenant data tables as Excel files and workspace files, is prepared asynchronously through the background worker, and is delivered by email with a random password and a 24-hour download link.
We proactively identify vulnerabilities before they can impact our system. External CREST-accredited cybersecurity firms perform regular white-box and black-box penetration tests across all public APIs and core infrastructure.
Floxoft supports RFC 6238-compliant TOTP two-factor authentication. Users can enable 2FA from their profile and link any authenticator app such as Google Authenticator or Authy. Every login generates a time-sensitive 6-digit code that expires after 30 seconds, making unauthorized access virtually impossible even if a password is compromised.
Repeated failed login attempts are automatically detected and blocked. After 5 failed attempts within a 15-minute window, access is temporarily suspended for that IP and account combination to prevent brute-force attacks. Active sessions are regenerated on every authentication event.
