Security & Data Privacy

When Floe conducts a demo with one of your prospects, it collects only what is necessary to run the demo, brief your team and, where a CRM is connected, update it. No tracking beyond the session. No resale. No aggregation across customers.

Data collected per conversation:

• Prospect name (if provided voluntarily during the conversation)
• Work email address (if provided voluntarily)
• Phone number (if provided voluntarily)
• Company name and inferred company size
• Job role and seniority
• Pain signals identified during discovery
• Product areas explored during the demo
• Full conversation transcript (stored in your Floe account, accessible to your team)
• ICP score assigned at end of conversation

We do not collect payment information, personal financial data, health data, or any sensitive personal categories. We do not fingerprint visitors or track them across sessions on other websites.

Floe data is stored on infrastructure hosted in the United States (Google Cloud, us-central1), with object storage on Cloudflare R2. Transfers of personal data from the EEA, the UK, or Switzerland are covered by the Standard Contractual Clauses incorporated into our Data Processing Addendum. If you have a specific regional hosting requirement, contact us and we will tell you whether we can meet it.

Retention periods:

• Conversation transcripts: retained for 90 days by default; configurable to 30 or 365 days
• ICP scores and lead records: retained until you delete them or deactivate your account
• CRM integration logs: retained for 30 days for debugging purposes
• Account data: retained for 30 days after account closure before permanent deletion

Deletion: You may request deletion of any prospect data at any time via the Floe dashboard or by emailing privacy@floe.so. Deletion requests are fulfilled within 5 business days. Data deleted from Floe is also deleted from all backup systems within 30 days.

Right to erasure (GDPR Art. 17): If a prospect contacts you to request deletion of their data, you can execute this request from within the Floe dashboard. We will confirm deletion in writing.

During onboarding, you share product documentation, UI flows, and ICP criteria with Floe. This information is the knowledge base that Floe uses to run demos for your visitors.

• Your product documentation is stored in isolated, tenant-separated storage, never combined with other customers' data
• We do not use your product documentation to train general AI models
• Your documentation is not shared with other Floe customers or third parties
• If you terminate your Floe account, all ingested documentation is deleted within 30 days
• UI flow configurations (the navigation paths Floe follows) are stored separately from product text and treated with the same isolation

Floe's access to your live product UI is scoped specifically to the pages and flows identified during onboarding. Floe does not have administrative access to your product and cannot read, modify, or export customer data held within your SaaS application.

When a CRM is connected (HubSpot or Salesforce, through their sign-in, or Leadrat, which you connect with its tenant and API key), Floe writes a recap of each qualified session to the prospect's record. Here is exactly what flows where:

Data sent to your CRM:

• Contact: found or created by email; a lead with only a phone is not sent to HubSpot or Salesforce. HubSpot contacts get name, company and job title, plus a phone number the prospect verified with a code when Floe creates the contact or the contact matched by their confirmed email has no phone; Salesforce contacts get name and job title.
• Recap: a Note (HubSpot) or Task (Salesforce) with the conversation summary, buying signals, questions, qualification answers, lead score or tier, the recommended next step, and a link to the Floe session.
• Deal: a Deal (HubSpot) or Opportunity (Salesforce), only if you turn deal creation on. It is off by default.
• Leadrat: a new lead with the prospect's name, their email when your contact-delivery policy allows it, and notes holding their company, role and the recap. A phone number they confirmed during the call appears in the notes, and is also sent as the lead's mobile number with the As stated policy. A number they verified with a code is sent as the mobile number under either policy, including one entered on a form; any other number entered only on a form is never sent.

By default a contact is written only after the prospect confirms their email address; for Leadrat, a prospect who gave only a phone and verified it with a code is written without one. See CRM contact delivery.

Data that stays in Floe:

• Session recordings and conversation transcripts, where recording is on, kept for the retention windows in our security documentation.

Floe connects to HubSpot and Salesforce with OAuth 2.0. For HubSpot it requests contact read and write access and deal write access, plus oauth for token refresh, and read access to owners, companies and deals. Floe reads a contact to look up the prospect by email before writing the recap note or deal to it. It reads the contact's company, open deals and their owners to email the lead's owner a copy of the recap, without storing the owner's details, and links a contact it creates to the company whose domain matches the email. Salesforce's OAuth grants API access limited to what the connecting Salesforce user can see; Floe uses it only to find or create contacts and write tasks and opportunities. We do not request admin permissions in either CRM.

Leadrat connects with the tenant and API key you enter. Floe stores the key encrypted, never shows it again, uses it only to create leads, and deletes it when you disconnect.

Periskope, the WhatsApp helpdesk, receives support escalations when you connect it with its API key: a ticket on the user's WhatsApp chat, with a private note holding who the user is, a summary, and the last messages of the conversation when transcripts are on. The key is stored encrypted and deleted when you disconnect. See Support escalation.

Floe is designed for compliance with major data protection frameworks. The table below reflects our current status as of the last update shown at the bottom of this page.

We do not claim certifications we have not received. The SOC 2 audit is in progress, reports will be made available to customers upon completion. If your organisation requires evidence of specific controls before audit completion, contact us to discuss what we can provide.

Enterprise customers have access to additional security controls not available on Starter or Growth plans:

• Single Sign-On (SSO): SAML 2.0 integration with your identity provider (Okta, Azure AD, Google Workspace)
• Data residency: Production currently runs in a single US region. Talk to us about regional hosting requirements before contracting
• Audit logs: Full access logs for all data reads, writes, and exports, exportable to your SIEM
• IP allowlisting: Restrict Floe dashboard access to specific IP ranges
• Business Associate Agreement (BAA): Available for organisations in healthcare-adjacent industries
• Dedicated infrastructure: Available for organisations requiring full tenant isolation at the infrastructure level
• Security review: We will complete your organisation's vendor security questionnaire and participate in third-party security assessments

For enterprise security onboarding, contact security@floe.so or request a security call through the book a demo page.

• Encryption in transit: All data transmitted between the visitor's browser, Floe's servers, and your CRM is encrypted using TLS 1.3
• Encryption at rest: All stored data (transcripts, ICP scores, account data) is encrypted at rest using AES-256
• Access control: Internal Floe team access to customer data is role-based and logged. Production data is accessible only to a small number of engineers for support and debugging purposes, with approval workflow
• Vulnerability management: Regular penetration testing; critical vulnerabilities patched within 24 hours
• Dependency scanning: Automated scanning of third-party dependencies for known CVEs
• Incident response: Documented incident response plan; customers notified within 72 hours of any data breach affecting their account, in compliance with GDPR Art. 33
• Subprocessors: Full list published at floe.so/subprocessors, with what each one processes and where. New subprocessors are posted at least 30 days before they begin processing