A new employee receives controlled access.

Within the EU, encrypted in transit and at rest. We document the chosen region and infrastructure before starting, both technically and contractually.

No. Not by Flowstead and, through our agreements with suppliers, not by model providers either. This is included in our data processing agreements.

That depends on the process, required quality and chosen deployment. We document the specific models and endpoints for each environment. In Flowstead Dedicated, models run on dedicated hardware without a public model API.

We connect with common ERP, email and accounting systems such as AFAS, Exact Online, SAP and Microsoft 365. Before starting, we determine exactly which secure connections your process needs.

Only authorised Flowstead engineers have access for management and support. Access is role-based, limited and logged.

Yes. It sets out roles, security arrangements, sub-processors, retention periods and how incidents are handled.

We return all data created during the engagement in a standard format. We then delete the environment according to the agreed procedure and confirm its removal.

The Dutch Cybersecurity Act comes into force on 15 August 2026 and implements NIS2. You must determine whether the law applies to your organisation. Flowstead supports supplier assessments with EU data location, limited access, logging and documented processing agreements.

The application determines the risk category and obligations. We assess this per process, build in human oversight and logging, and provide the required transparency. Flowstead does not build digital colleagues for recruiting, selecting or assessing employees.