Security you can explain to your auditor.

A passkey is the way in: a fingerprint, a face or the device PIN, bound to FLO so it cannot be used on a lookalike site. People can keep several passkeys and see every device that holds one.

• A verified mobile number and a six digit code set up the first sign in and recover a lost account. The code is never a daily way in, because a code that works every day is worth stealing.
• Recovery needs more than a guess: the phone code, then security answers, then an administrator’s approval or a waiting period with a notice to the owner.
• Deleting or exporting anything asks for a passkey from the last five minutes, even inside a signed in session.
• The Console asks for a hardware security key before it opens, as well as a passkey.

Every message is checked for more than spam: a display name that matches a colleague from an address that does not, lookalike and newly registered domains, a reply address that differs from the sender, a thread that suddenly changes bank details, codes hidden in images and attachments with macros or archives inside.

• One banner, the most important reason, in plain words. Never a score.
• Held mail stays visible with a request to release it, instead of silently missing.
• The report button removes the message, finds the same campaign across the company and pulls it from every mailbox. The reporter hears the outcome and the administrator sees who received, opened and clicked.
• Every link in incoming mail is checked again at the moment of the click. Clean links pass silently, suspicious ones show the real destination and the reason, known bad ones are blocked.
• Attachments open as a safe converted preview first. Releasing the original is a deliberate act.
• A warning on the first reply to an outside address. Undo send for the moment after.

A root key wraps a key for each company, which wraps a key for each person and each file. Rotating a company key rewraps the level below it instead of rewriting everything.

• Every stored file sits under its own key. Sensitive database fields sit under the company key: subjects and previews, contact details, phone numbers, security answers, transcripts, booking answers and audit details.
• Backups inherit this and are useless without the keys.
• Traffic uses TLS 1.3 everywhere. Mail between servers is required to travel encrypted. File links are signed and short lived.
• Deleting a person destroys their key after the retention window. Deleting a company destroys the company key. Once backups exist, that is the only deletion that stays true.

• Every query is scoped to your company, with row level security in the database as the backstop.
• Your company id comes from the signed in session, never from the browser.
• Storage is separated per company and so are the keys.
• Staff access across companies goes through one audited path that records the real person behind it.

FLO IQ scans mail, links and files, writes summaries and searches across everything. It is built so that your data does its job and goes nowhere else.

• Names, addresses and phone numbers are replaced with tokens before a model sees the text. They are restored afterwards.
• Fields are sent only when a rule says they may be. Anything unknown is dropped.
• Requests are made with zero retention. Your data never trains a model.
• Each feature can be switched off per team, including whether content may reach an outside model at all.
• Every call is recorded with its cost and verdict, never its content.

• An append only audit log with the value before and after every change, copied daily to storage under a lock.
• Point in time recovery for the database and a nightly backup under a lock that nobody can shorten.
• A restore drill every quarter, because a backup nobody has restored is a hope.