Data protection and security
You are asking people to answer honestly. That comes with obligations.
Six principles govern how we handle assessment data. The detail behind them — agreements, security documentation, platform settings — is worked through with you before anything goes live.
The principles
Six things we hold to
Nobody is profiled without knowing
Every assessment is completed by the person themselves, knowingly and with their consent. In development work they receive their own report; a manager or trainer may see it first in order to prepare for the conversation, but never instead of them.
Reports do not rank people
No Discflow report scores one person above another, and none should be used to decide who is hired, promoted or let go.
Your data is stored in the EU
On Amazon Web Services in Frankfurt, Germany. FlowConnect's AI processing runs in Sweden. Both are inside the EU.
Nothing you enter trains an AI model
Not ours, not Microsoft's, not anyone else's. What your people write in FlowConnect stays yours.
We do not sell, rent or trade data
There is no second business here. We are paid for assessments and for the work around them.
You can get it back, or get it deleted
Ask us and we will export it or delete it, within the timescales the law sets.
Access
Who can see what
Your administrator
The FlowHub administrator in your organization can open any report in your account. That comes with the role rather than around it, and in practice there is rarely a reason to.
Trainers and practitioners
Whoever is delivering a session usually reads the reports beforehand. That is how a debrief gets prepared rather than improvised.
FlowConnect is private to the person
An administrator can switch someone's FlowConnect access on or off. They cannot see the questions asked, the situations described or the reflections recorded.
Flow360 raters
Feedback is only shown once a minimum number of raters have responded, so individual raters cannot be identified. The exception is the leader's own rating, which is a single response and identifiable by definition. Everyone involved should know that before they start.
The facts
Where your data lives
| Hosting | Amazon Web Services |
|---|---|
| Data residency | Frankfurt, Germany. FlowConnect AI processing in Sweden |
| Encryption | In transit and at rest |
| Retention | While the account is active, and up to five years after last activity |
Our Privacy Policy
Sets out the full picture, including who processes data on our behalf and how to exercise your rights.
For your security team
What we send when they ask
Most organizations run a security review before a rollout. Send us the questionnaire and we will complete it, or ask for any of these documents and we will send them.
One business day, wherever you are.
- Data Processing Agreement
- Privacy Policy and Cookie Policy
- Sub-processor list
- Transfer risk assessment
- FlowConnect AI data security briefing
Next
Still deciding whether any of this is credible?
Read a full sample report, or the evidence behind the instrument.