Bloomflow is

Bloomflow is hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Bloomflow is publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Bloomflow is is SOC 2 compliant and holds ISO 27001, GDPR, ISO 27701. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Bloomflow is hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@bloomflow.com or via a /security page (Bloomflow is lists a security contact).

Bloomflow is lists 5 subprocessors on its trust center, including Amazon Web Services, Microsoft Azure, OVHCloud, Cloudflare, Mailjet. Buyers use this for fourth-party risk review.

Bloomflow is hosts on AWS, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Bloomflow is's trust center is at https://trust.bloomflow.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

As a data controller using our innovation management platform, you have specific obligations under GDPR. We've built privacy controls directly into our platform to help you meet these requirements in practice. #### Data Retention & Automated Deletion Automated retention workflows that enforce your data retention policies: - For Platform Users: Set retention rules based on days since last connection or days since suspension. Automated workflows delete users without manual intervention. - For External Contacts: Configure retention based on days since last interaction (e.g., "delete contacts with no activity in 2 years"). - What happens during deletion: All PII is removed from user records while preserving referential integrity. Activity logs are retained but de-identified. Benefit: Your retention policies enforce themselves—no need to manually remember to delete old data. #### Data Subject Access Requests (DSARs) Self-service data exports eliminate DSAR bottlenecks: - Individual platform users can export their complete profile data as Excel files - Bulk export capabilities for all external contact information - No IT involvement required—your team responds in minutes, not days Benefit: When someone requests their data, you can fulfill the request immediately without involving developers. #### Right to Erasure (Data Deletion) Two deletion methods: 1. Automated deletion workflows that anonymize users based on retention rules 2. Provisioning integration for automatic deletion when users are removed from your identity system What gets deleted: All PII in user records, profile information, contact details What's preserved: User record shell (preventing broken references), de-identified activity logs, system integrity Benefit: Honor erasure requests while maintaining your innovation project history. #### Data Minimization Built-in protections against over-collection: - Configure optional vs. required fields—only collect what's necessary - Warning messages on free text…

We provide automated retention workflows that you can configure based on your organization's retention policies: For Platform Users: - Set retention rules based on days since last connection (e.g., "delete users inactive for 365 days") - Set retention rules based on days since suspension (e.g., "delete suspended users after 90 days") - Automated workflows run these deletions without manual intervention For External Contacts: - Configure retention based on days since last interaction - Automated processing ensures compliance with data minimization principles What happens during deletion: - All PII is removed from user records - Records remain to preserve referential integrity (preventing broken links) - Activity logs are retained but de-identified Real-world benefit: Once configured, your retention policies enforce themselves. The platform handles deletion automatically based on the rules you've set.

We make DSARs self-service for your team: For Individual Platform Users: - Users can export their complete profile data as an Excel file - Self-service capability means no IT ticket required - Export includes all personal information in their user profile For External Contacts: - Export all information about external contacts in bulk - Quickly fulfill access requests without database queries - Standard format makes it easy to provide to data subjects Real-world benefit: When an employee or external contact requests their data, your team can respond in minutes—not days. No need to involve developers or create custom database exports.

Yes, through two methods: 1\. Automated Deletion Workflows: - Configure workflows to automatically anonymize users based on retention rules - Removes all PII while maintaining referential integrity 2\. Provisioning Integration: - If you've set up user provisioning, users can be fully deleted - Triggered automatically when removed from your identity system What gets deleted: - Every piece of PII in the user's database record - User profile information and contact details What gets preserved: - The user record shell (to prevent broken references to projects/partners) - Activity logs (de-identified—no longer linked to the individual) Real-world benefit: You can honor erasure requests while maintaining your innovation project history. Past contributions remain visible, but the individual is no longer identifiable.

We've built data minimization into the platform design: 1\. Optional vs. Required Fields: - You control which fields are mandatory - Only collect what's necessary for your innovation management purposes - Flexibility to adjust requirements as your needs change 2\. Protection Against Over-Collection: - Free text fields display warning messages - Alerts users that PII should not be entered in open text areas - Proactive prevention of unnecessary personal data collection 3\. Structured Data Collection: - We favor structured fields over free text - Reduces risk of inadvertent PII collection - Makes data management and compliance easier Real-world benefit: Your users are guided toward collecting only what's needed. The platform actively prevents the common mistake of collecting excessive personal information in comment fields or notes.

We provide granular, role-based access controls that let you implement the principle of least privilege: Partner & Project Level Permissions: - Define exactly who can see what at the partner level - Control visibility at the project level - Ensure individuals only access data necessary for their role Configurable Rights System: - Highly flexible permission structure - Align access rights with organizational roles - Prevent unauthorized access to sensitive innovation data Real-world benefit: Not everyone needs to see all innovation projects or partner information. Your HR team, legal team, and innovation managers can each have appropriately scoped access—seeing only what they need to do their jobs.

Yes. We automatically log key activities to support your accountability obligations: What We Log: - Key security events - Important data access activities - Changes to partners and projects - Critical system actions How You Can Use It: - Security: Monitor for unauthorized access attempts - Compliance: Demonstrate what happened to data - Investigation: Review timeline of edits for specific partners or projects - Accountability: Show regulators your controls are working Visibility: - Timeline view shows edit history for partners and projects - Activity tracking provides context for data changes - Historical record supports compliance documentation Real-world benefit: If a regulator asks "who accessed this data?" or "when was this changed?", you have the logs to answer. The platform maintains the paper trail you need.

Bloomflow and Agorize, operating under a shared Information Security & Privacy Management System (ISPMS) since their November 2024 merger, apply a security-by-design, risk-based and privacy-by-design approach to protect data against unauthorized access, loss, or alteration. These measures are continuously reviewed, tested, and improved.

The ISPMS aligns with ISO/IEC 27001:2022 (information security management) and ISO/IEC 27701:2019 (privacy information management) standards. Certificates and the Statement of Applicability are available at the TrustCenter

This depends on contracts with our clients — we have several providers across multiple geographies. For European clients, everything is hosted within the European Union (See the questions "What cloud providers are available?")

Security governance is led by a CISO, supported by cross-functional teams trained to monitor, enforce, and evolve security & privacy controls. Both Agorize and Bloomflow share this security governance structure under the same ISPMS since their November 2024 merger.

Yes, we support Single Sign-On (SSO) and we have all classical connectors (SAML2/ADFS, OIDC, oAuth2 etc.)