Bloomflow is

Bloomflow is is SOC 2 compliant. On SOC2C this listing is Listed.

According to Bloomflow is's public trust center, Bloomflow is is ISO 27001 certified. On SOC2C this listing is Listed.

According to Bloomflow is's public trust center, Bloomflow is is GDPR compliant. On SOC2C this listing is Listed.

According to Bloomflow is's public trust center, Bloomflow is is ISO 27701 certified. On SOC2C this listing is Listed.

Yes. Bloomflow is's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

As a data controller using our innovation management platform, you have specific obligations under GDPR. We've built privacy controls directly into our platform to help you meet these requirements in practice. #### Data Retention & Automated Deletion Automated retention workflows that enforce your data retention policies: - For Platform Users: Set retention rules based on days since last connection or days since suspension. Automated workflows delete users without manual intervention. - For External Contacts: Configure retention based on days since last interaction (e.g., "delete contacts with no activity in 2 years"). - What happens during deletion: All PII is removed from user records while preserving referential integrity. Activity logs are retained but de-identified. Benefit: Your retention policies enforce themselves—no need to manually remember to delete old data. #### Data Subject Access Requests (DSARs) Self-service data exports eliminate DSAR bottlenecks: - Individual platform users can export their complete profile data as Excel files - Bulk export capabilities for all external contact information - No IT involvement required—your team responds in minutes, not days Benefit: When someone requests their data, you can fulfill the request immediately without involving developers. #### Right to Erasure (Data Deletion) Two deletion methods: 1. Automated deletion workflows that anonymize users based on retention rules 2. Provisioning integration for automatic deletion when users are removed from your identity system What gets deleted: All PII in user records, profile information, contact details What's preserved: User record shell (preventing broken references), de-identified activity logs, system integrity Benefit: Honor erasure requests while maintaining your innovation project history. #### Data Minimization Built-in protections against over-collection: - Configure optional vs. required fields—only collect what's necessary - Warning messages on free text…

We provide automated retention workflows that you can configure based on your organization's retention policies: For Platform Users: - Set retention rules based on days since last connection (e.g., "delete users inactive for 365 days") - Set retention rules based on days since suspension (e.g., "delete suspended users after 90 days") - Automated workflows run these deletions without manual intervention For External Contacts: - Configure retention based on days since last interaction - Automated processing ensures compliance with data minimization principles What happens during deletion: - All PII is removed from user records - Records remain to preserve referential integrity (preventing broken links) - Activity logs are retained but de-identified Real-world benefit: Once configured, your retention policies enforce themselves. The platform handles deletion automatically based on the rules you've set.

We make DSARs self-service for your team: For Individual Platform Users: - Users can export their complete profile data as an Excel file - Self-service capability means no IT ticket required - Export includes all personal information in their user profile For External Contacts: - Export all information about external contacts in bulk - Quickly fulfill access requests without database queries - Standard format makes it easy to provide to data subjects Real-world benefit: When an employee or external contact requests their data, your team can respond in minutes—not days. No need to involve developers or create custom database exports.

Yes, through two methods: 1\. Automated Deletion Workflows: - Configure workflows to automatically anonymize users based on retention rules - Removes all PII while maintaining referential integrity 2\. Provisioning Integration: - If you've set up user provisioning, users can be fully deleted - Triggered automatically when removed from your identity system What gets deleted: - Every piece of PII in the user's database record - User profile information and contact details What gets preserved: - The user record shell (to prevent broken references to projects/partners) - Activity logs (de-identified—no longer linked to the individual) Real-world benefit: You can honor erasure requests while maintaining your innovation project history. Past contributions remain visible, but the individual is no longer identifiable.

We've built data minimization into the platform design: 1\. Optional vs. Required Fields: - You control which fields are mandatory - Only collect what's necessary for your innovation management purposes - Flexibility to adjust requirements as your needs change 2\. Protection Against Over-Collection: - Free text fields display warning messages - Alerts users that PII should not be entered in open text areas - Proactive prevention of unnecessary personal data collection 3\. Structured Data Collection: - We favor structured fields over free text - Reduces risk of inadvertent PII collection - Makes data management and compliance easier Real-world benefit: Your users are guided toward collecting only what's needed. The platform actively prevents the common mistake of collecting excessive personal information in comment fields or notes.