Your data, your region, your rules.
Buying an ERP means entrusting your entire organization to one system. Here we say exactly where your data is, who can access it, how it is monitored, and what is still on the way.
99.9%Monthly availability target
24/7Infrastructure and security monitoring
4 + 5Hosting regions live + coming
AES-256Encryption at rest; TLS 1.3 in transit
15 minutesRecovery point objective (RPO)
Data centers
LiveComing soonYou choose where your data is stored.
When you create your account you pick a region, and your data never leaves it without your request. Each company's data is stored separately; backups are encrypted in the same region, with one copy in a backup region within the same jurisdiction.
TehranFrankfurtDubaiRiyadhIstanbulKuala LumpurSydneyTorontoLos AngelesIran
Tehran · Live regionIran's data protection laws; no dependence on the international internetEuropean Union
Frankfurt · Live regionGDPR; for European branches and German-speaking companiesUAE
Dubai · Live regionUAE data protection law (PDPL); covers the GulfSaudi Arabia
Riyadh · Live regionSaudi data residency requirements; ready for Phase 2 e-invoicingTurkey
Istanbul · Coming soon · 2026-27KVKK; for Turkish-speaking companiesMalaysia
Kuala Lumpur · Coming soon · 2027-28PDPA; covers Southeast AsiaAustralia
Sydney · Coming soon · 2027-28Privacy Act; covers OceaniaCanada
Toronto · Coming soon · 2027-28PIPEDA; covers North AmericaUnited States
Los Angeles · Coming soon · 2027-28CCPA; US West and PacificSecurity
Four layers, each independent of the others.
If one layer fails, the next must stop a leak on its own. This is the design principle behind everything you read below.
01Infrastructure
Data centers with physical access control and redundant power and coolingPrivate network between services; no database is directly connected to the internetAES-256 disk encryption with keys rotated every 90 daysOS hardening and security patches within 72 hours of release
02Network and edge
TLS 1.3 enforced; HSTS and automatic certificatesWAF with OWASP rules and DDoS protection at the edgeRequest rate limiting and automatic blocking of attacking IPsDedicated connectivity (VPN / static IP) for enterprise customers
03Application and identity
Two-factor sign-in (TOTP / SMS) and enterprise SSO (SAML / OIDC)Granular permissions per action: view, create, approve, delete, printSigned sessions with expiry and remote sign-out of all devicesCode review and dependency scanning on every release
04Data
A separate database for each company; no shared tablesHash-chained, tamper-proof audit trail for every changeMasking of sensitive data in logs and test environmentsFull data export and deletion on your request, within 30 days
24-hour monitoring
We know before you do.
Every region is monitored from outside and inside: availability from multiple geographic points, response time of each service, database and queue health, and unusual behavior in security logs. Alerts go straight to the on-call engineer, not to an email inbox.
Availability checks every 30 seconds from multiple points worldwideSign-in behavior analysis (SIEM): location, device, and unusual patternsWAF and DDoS protection at the network edge, with continuously updated rulesAutomated vulnerability scanning on every release
Sample view; live data is not connectedNo figures are shown here, not even sample ones
API and web app—
Mobile app—
Database and queues—
Liana AI—
Email, SMS, and telephony—
Last 90 daysNormalMinor slowdownOutage
—Mean time to detect
—Mean time to resolve
—Incidents in 90 days
—Blocked attempts / 24 hours
Technical team
The people behind 24/7.
Monitoring without people is just charts. Flosa's operations and security team is responsible for monitoring and incident response.
Infrastructure operations (SRE)Capacity, deployment, backup, and recovery; owns the availability targets.24/7 on-call
Security and incident response (SOC)SIEM monitoring, threat analysis, penetration testing, and vulnerability management.Reports to the Chief Information Security Officer (CISO)
Product engineeringSecurity code review, threat modeling, and root-cause fixes for incidents.Weekly releases with automatic rollback
Customer success and supportCustomer communication during incidents, DPA, and security questionnaires.Questionnaire responses within 3 business days
What happens when an incident occursIncident response process
1Under 5 minutesDetectionAutomated alert or user report; the incident is logged and its severity set.
2Under 30 minutesContainmentIsolate the affected service or account without interrupting other customers.
3Per contractNotificationNotify affected customers; in a data breach, within 72 hours at most.
4Per RTOFix and recoveryPatch, restore from backup, and verify data integrity.
5Within 5 business daysPost-incident reportRoot-cause analysis, corrective action, and a published report for enterprise customers.
Backup and continuity
Even the worst day should be a working day.
Taking backups is not enough; we have to prove they restore. Our goal is that every quarter, a full restore of a sample company from backup is rehearsed and its time recorded.
RPO: maximum data loss15 minutesTarget: incremental backup every 15 minutes; full backup every night.
RTO: maximum time to recover4 hoursTarget for enterprise and mission-critical customers; 12 hours for the rest.
Backup retention35 daysPoint-in-time recovery over the past 35 days; monthly archive for up to 1 year.
Off-site copies2 copiesAt a second site in the same region; encrypted and immutable.
Recovery drillQuarterlyTarget: full restore of a sample company and recording of the actual time.
RedundancyActive / standbyAutomatic failover of the database and services if one site fails.
Privacy and data ownership
The data is yours. We are only the custodian.
Full data ownershipYour data and exports belong to you; Flosa has no right to use them other than providing the service.
No selling, no adsYour data is never sold to a third party or analyzed for advertising.
Liana AI within your permissionsThe AI sees only information that the same user is allowed to see; no general model is trained on your data.
Flosa staff accessOnly at your request, to resolve an issue, with dual approval and full logging; revocable at any time.
Free exitFull data export (Excel/CSV/JSON) at any time; permanent deletion within 30 days after the contract ends.
Data processing agreement (DPA)For enterprise customers, a DPA in line with GDPR / PDPL is signed, with the list of subprocessors.
Licenses and certifications
What others have verified.
Once legally confirmed, each certification will link to the issuing authority's lookup page. The validity date and certificate number will be added at the same time; until then, unverified certifications are marked "Verification in progress".
Knowledge-based companyVerification in progress
Vice Presidency for Science, Technology and Knowledge-Based Economy (Iran)Confirmation of a technology product and eligibility for the statutory knowledge-based company benefits.
AFTA certificateVerification in progress
AFTA Strategic Management Center (Iran)National-level security assessment of the product; a prerequisite for deployment in government and banking organizations.
ISO/IEC 27001Verification in progress
Third-party auditInformation security management system; access control, encryption, backup, and incident response controls.
Trusted tax companyVerification in progress
Iran National Tax AdministrationSend e-invoices directly to Iran's Moadian system from within Flosa.
ZATCA complianceVerification in progress
Zakat, Tax and Customs Authority (Saudi Arabia)Phase 2 e-invoicing for companies based in Saudi Arabia.
Informatics High Council ratingVerification in progress
Management and Planning Organization (Iran)Qualification for government tenders and contracts.
Digital publishing licenseVerification in progress
Center for Development of Culture and Art in Cyberspace (Iran)Legal license to publish software in the country.
Electronic trust symbol (Enamad)Trust
E-Commerce Development Center (Iran)Seller identity verification and commitment to online business regulations.Certificate lookup ←
National registration markVerification in progress
Digital Media Organization (Iran)Registration of the digital media outlet with the Ministry of Culture and Islamic Guidance.
Computer guild system membershipVerification in progress
Tehran Province Computer Guild OrganizationCorporate membership and adherence to the guild's professional code of ethics.Coming soonNot yet released
We list these separately and honestly so you know what is ready today and what is not.
SMS incident notifications for all plansSOC 2 Type II reportCustomer-managed encryption keys (BYOK)New regions: Istanbul, Kuala Lumpur, Sydney, Toronto, Los Angeles
Have a security question or a vendor questionnaire?
We send the security architecture document, the data processing agreement (DPA), and answers to security questionnaires within 3 business days. Found a vulnerability? Bug bounty program ←