ISO/IEC 27001:2022
Information security management system. Valid until 30 October 2029, with surveillance reviews each year.
SECURITY & DATA PROTECTION
Facility data you can protect, audit and take back.
FacilityFlow is facility management software with security built into the platform: a tamper-evident audit trail, AES-256-GCM encryption at rest, four classification levels, role-based access with segregation of duties, and MFA per role. It is designed for public-sector security schedules and regulated sites. It is built and supported by Techseria Private Limited, certified to ISO/IEC 27001, 27017, 27018 and SOC 2 Type 2.
No commitment Fixed-fee Discovery Response within 4 hours
Trusted Security
Certified management of the company behind the product.
Techseria Private Limited is certified to ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2025 and SOC 2 Type 2. Our Trust Center lists certificate numbers, validity dates and how to request documentation.
ISO/IEC 27017:2015
Information security controls for cloud services. Valid until 29 October 2029, with surveillance reviews each year.
ISO/IEC 27018:2025
Protection of personal data in public cloud services. Valid until 29 October 2029, with surveillance reviews each year.
SOC 2 Type 2
Independent audit of security controls operating over time. Valid until 29 October 2029, with surveillance reviews each year.
Capabilities
Security controls built into every layer of FacilityFlow.
What your IT, security and audit teams can check.
Data Protection
Four information classification levels (Official Open, Official Closed, Restricted, Confidential). Files above a set level are encrypted at rest with AES-256-GCM and a key per file. Keys are held in Azure Key Vault (RSA-HSM) or a local provider, with scheduled rotation.
Access Control
Role-based permissions with 33 FacilityFlow roles and ready-made role profiles. Field permission levels and Job Site permissions limit what each person sees, and every API method checks permission on the server.
Authentication
Password policy with length, strength, history and expiry. MFA per role, lockout with progressive delay, CAPTCHA, single session and idle and absolute timeouts. API keys, OAuth2 and LDAP are supported.
Audit & Accountability
Changes, logins, privilege changes, configuration changes and exports go to a hash-chained, append-only log, verified daily against an external anchor. A monthly review flags failed-login and export spikes and out-of-hours admin activity.
Identity & Access Governance
Users are created only from approved access requests. Conflicting role pairs are blocked, delegations are respected, dormant accounts are disabled after open work is handed over, and periodic access reviews remove access that is no longer needed.
Deployment & Data Ownership
Cloud, private cloud or on-premise. One site per customer, with multi-company and multi-site inside it. At exit, a full export per site, contract or project is handed back, followed by witnessed secure deletion.
COMMERCIAL PRICING MATRIX
Security controls at a glance.
Implemented controls in the product. Ask us for the detail your security schedule needs.
Scroll horizontally to view all columns
| Control | What FacilityFlow does |
|---|---|
| Tamper-evident audit trail | Hash-chained, append-only log enforced by database triggers, with secrets redacted. Retained for at least 12 months, then archived with a SHA-256 manifest. |
| Encryption at rest | AES-256-GCM per file for classified documents, with key register and scheduled key rotation. |
| Information classification | Four levels applied to records, files and documents. |
| Segregation of duties | Conflicting role pairs are blocked. Approved exceptions are time-limited and audited. Contractor roles stay out of Superintending Officer decisions. |
| Data loss prevention | Daily export row caps per role, watermarked exports and PDFs, and Confidential attachments blocked from external email. |
| Secure uploads | Extension allow-list, file-content check, executables and scriptable SVG blocked, and optional ClamAV malware scan. |
| Mobile device control | Device registry, remote wipe, minimum app version, and photo time and GPS checks. |
| Retention, purge and exit | Retention policies, approved purge with crypto-erase and destruction certificates, full export at exit and witnessed deletion. |
COMMERCIAL PRICING MATRIX
Safety and HSE compliance built into the workflow.
FacilityFlow keeps permits, risk assessments, incidents and inspections in the same system as the work orders they control.
Scroll horizontally to view all columns
| HSE capability | What It Delivers |
|---|---|
| Permit to Work (PTW) | IFM Work Permit and Internal PTW with isolation points, hazards, PPE, gas tests, checklists and approval workflows. Alerts when a permit is missing. |
| LOTO (Lockout/Tagout) | LOTO isolation is part of planned maintenance work, so isolation is recorded against the job. |
| MSRA (Method Statement & Risk Assessment) | Hazards, equipment, PPE and team, with three-level approval: Technical, HSE and Client. Daily checks and reminders for MSRAs that are due or missing. |
| Incident Investigation | Injured persons, witnesses, contributing factors, root cause analysis, corrective actions and follow-ups, on a workflow. |
| Safety Inspections | Checklist-driven inspections with corrective actions. |
| Compliance Calendar | Statutory licences, certificates and renewal cycles on one calendar, with reminder steps and overdue escalation. |
| Certifications | Site licences, personnel certificates and company certificates tracked with renewal reminders. 22 licence types are pre-loaded. |
| Safety Audit Trail | Version history, workflow history, signatures and the Evidence Library keep a searchable record of every safety action. |
Have specific security or compliance requirements? Talk to us.
Public-sector and regulated customers often need on-premise deployment, data residency, specific audit evidence or access reviews. We will walk through the relevant controls with your IT, security and compliance teams before you decide.
Faq