Topicflow

After a user gives Topicflow permission to access their Google or Microsoft calendar, we will periodically fetch event data from the calendar. We store information such as the title and time of an event in our database, so that we can present that information in the Topicflow user interface. We only fetch events 60 days into the future, and if an event is not used in Topicflow (if no topics are added to the meeting agenda), we delete all information about the event from our database after 30 days. A user may request that their information or events are deleted from our database at any time. Before doing so, they are able to export their data in order to retain it themselves.

Topicflow does not store any usernames or passwords, as we only support SSO-based authentication with Google or Microsoft. Users may choose to use multi-factor authentication with their Google/Microsoft account for added security. Topicflow sessions are limited to a reasonable length of time, so that users must periodically re-authenticate.

Our databases are backed up daily, and backups are retained for 30 days. We practice the database recovery process at least once a year, to ensure that our disaster recovery procedures are working.

Topicflow servers are all hosted with AWS, currently in US-based datacenters. AWS has multiple security certifications in place, such as SOC2. Our AWS-hosted servers are contained within virtual private networks, and all administrative access to the servers themselves requires a secure VPN connection. Access to AWS requires multi-factor authentication. We capture audit logs from AWS to an external logging system. Our infrastructure is defined using an IaC (Infrastructure as Code) tool, to ensure that all changes are logged and that the infrastructure can be reproduced as needed. Our AWS services are hosted across multiple availability zones, to minimize the chance of downtime if AWS experiences issues. Although our services are currently hosted in a single AWS region, our provisioning is highly automated and we are able to restart the service in a different region quickly.

All communication between our internal services and between users and our services is encrypted using TLS. All data at rest is encrypted using AES-256 encryption.