Where is data stored by default?

In a data centre in the United States, with every workspace isolated from the others. If your organisation has a residency requirement, talk to us before you sign up.

Yes. Standard Contractual Clauses, sub-processor list, and breach-notification SLA included. Custom DPAs available for Enterprise.

Is SSO an extra cost?

No. SAML 2.0 SSO and SCIM 2.0 provisioning are included on the Pro plan and above. They are not Enterprise-only upgrades.

How do you handle subprocessors?

The current subprocessor list is available on request from the contact page. Card payments go through Stripe and PhonePe.

Security · Trust · Compliance

Built for procurement — not a feature flag.

Q: Can I get the SOC 2 report?

Yes — under NDA. Email contact@flaxxa.com from a corporate domain and we will share the latest Type II audit, including auditor name and observation period.

SAML SSO, SCIM provisioning, two-factor login, a full audit log, and SOC 2 and ISO 27001 compliance.

Request SOC 2 report Read the DPA

No credit card

Free plan

Cancel anytime

app.flaxxa.com / admin / security All checks passing

SOC 2

Type II

ISO 27001

Certified

GDPR

Ready

Encryption· TLS 1.3 + AES-256

Active

SSO· SAML 2.0 + SCIM

Enforced

Audit log· every workspace

Live

Single sign-on· SAML + SCIM

Compliance

SOC 2

DPA · signed

Standard SCCs · Annex II

Type II certified: SOC 2
Information security: ISO 27001
And SCIM provisioning: SAML SSO
Two-factor login: 2FA

Certifications & frameworks

The badges procurement actually asks for.

SOC 2 Type II

Annual audit. Latest report available under NDA.

ISO 27001

Information security management certified.

GDPR ready

DPA available on request.

CCPA

California Consumer Privacy Act compliant.

PCI DSS

Card payments are handled by Stripe and PhonePe; card numbers never reach Flaxxa.

Defence in depth

Six pillars. Every plan.

We don't gate security behind a $30K Enterprise upgrade. The same posture protects every workspace, from solo founder to Fortune 500.

Encryption

TLS on every connection. Sensitive fields such as tokens and API keys are encrypted with AES-256 before they are stored.

Identity & access

SAML 2.0 SSO, SCIM 2.0 provisioning, two-factor login and role-based access for every workspace.

Tenant isolation

Every record belongs to one workspace, and every query is scoped to it: one customer never sees another customer's data.

Audit log

An audit log of agent actions, configuration changes and API calls in every workspace.

Payments

Card payments are handled by Stripe and PhonePe. Card numbers never reach Flaxxa.

Compliance

SOC 2 and ISO 27001 compliant. A DPA and the subprocessor list are available on request.

Security FAQ

What every procurement team asks first.

Yes — under NDA. Email [email protected] from a corporate domain and we will share the latest Type II audit, including auditor name and observation period.

Get started in minutes

Bring procurement. We'll bring the paperwork.

Talk to us about SOC 2, DPAs and the subprocessor list.

Talk to Sales Start Free

Free plan · No credit card · Cancel anytime

Type II · NDA available: SOC 2
Information security: ISO 27001
And SCIM provisioning: SAML SSO