Everything operators need
to sign off.

Defense-in-depth across every layer of the orchestration stack. Card data never crosses our boundary.

• TLS 1.3 end-to-end on every parent → sub-brand call. HSTS preload list enforced.
• AES-256 at rest for every ledger row. Per-row envelope encryption via AWS KMS. 90-day key rotation.
• Key rotation automated; CMKs tracked, expired keys quarantined, never reused.
• MFA required for every portal login. WebAuthn / FIDO2 hardware keys supported for privileged roles.
• Signed webhooks (HMAC-SHA256) on every handoff. Idempotency keys + retry with backoff.

Privacy-by-default. Data minimization, purpose limitation, and a 30-day DSR workflow baked in.

• GDPR aligned — Article 28 processor obligations, Art. 32 security measures, 72-hour breach notification.
• CCPA / CPRA aligned — consumer rights requests honored within statutory windows.
• DPA template available on request — operator legal review, no gate.
• Data residency US-only — AWS us-east-1 + us-west-2 active-active, no cross-border transfer.
• Data minimization — orchestration ledger stores only the fields required to reconcile.

Card data stays inside regulated processor boundaries. multiflow sits on top as SAQ D-SP service provider.

• PCI DSS Level 1 inherited via acquirer partners (Stripe, Square, Authorize.net). No PAN on our infrastructure.
• SOC 2 Type I complete. Type II audit underway — target Q3 2026. Trust Services Criteria: Security + Availability + Confidentiality.
• SAQ D-SP attestation available under NDA for enterprise review.
• ISO 27001 pre-audit documentation available. Full certification on 2027 roadmap.
• HIPAA not applicable — payment data is financial-exempt under 45 CFR 164.501. BAA on edge cases.

Active-active across two AWS regions. Even in a full multiflow outage your processor keeps taking payments.

• 99.97% uptime — trailing 12 months on the orchestration API.
• Public status page — multi-flow.pro/status — real-time incidents + 90-day history.
• Incident response SLA — 15-minute P1 ack, 60-minute containment, 72-hour post-incident review.
• RTO 15 min · RPO 60 sec — failover tested quarterly.
• 35-day PITR — point-in-time recovery window on ledger data.

Every settings change, login, and API action is logged at the per-brand level. SIEM-forwarded, immutable, 7-year retention.

• Per-brand audit trail — every ledger mutation tagged with actor, timestamp, source IP, and diff.
• Role-based access (RBAC) — every role scoped to specific sub-brands. Least-privilege enforced.
• Quarterly access review — operator-initiated; stale roles auto-flagged.
• 7-year immutable archive — appended to WORM storage, cryptographically signed.
• Exportable — operators can pull their own audit log via API at any time.

Every third party that touches any slice of your operational data, named and scoped. 30-day advance notice on material changes.

• Full list at /sub-processors/ — AWS, Cloudflare, Datadog, Sentry, SendGrid, PagerDuty, processor partners.
• Purpose + data scope documented per vendor.
• 30-day advance notice on additions or material scope changes (enterprise tier).
• Vendor DPAs in place with every sub-processor that touches customer data.
• Annual vendor security review — SOC 2s re-collected, scoped access re-validated.