Security Policy
How we protect the Fluye platform and our clients' information: encryption, access control, backups and incident management.
1. Our commitment and scope
Fluye moves quotes, invoices, collections and payments between companies, and connects that history with insurers and banks. That information is our clients' most sensitive asset, and protecting it is a condition for the service to exist. This policy describes how we do it, in plain language and without promises we cannot keep.
It applies to the entire Fluye platform: the website (usefluye.com), the applications for selling, buying and operating companies, the integrations with partners and the infrastructure that supports them. The platform is the same in every country where we operate, so this policy is unique and applies to Venezuela, Qatar and any future market. What changes by country is whom we notify of an incident, which is set out in the country annexes of the Privacy Policy.
Fluye's security is managed by myservy's engineering team, with a designated responsible person who reports to management. The operation in each country (Sbcompanies C.A., RIF J-508489772, in Venezuela; myservy LLC, QFC No. 05314, in Qatar) is governed by this same policy.
2. Infrastructure and providers
All of Fluye's infrastructure runs on Microsoft Azure: applications, databases, file storage, backups, transactional email, logs and monitoring. We do not operate our own servers or split the platform across several cloud providers.
Azure holds internationally recognised security certifications (ISO/IEC 27001, ISO/IEC 27018, SOC 1, SOC 2 and SOC 3, among others) and physical, network and personnel controls in its data centres. Fluye uses Azure's managed services for encryption, identity management, keys and secrets, and backups, so the measures described in this policy rely on that platform.
Outside Azure, only the payment, verification and screening providers described in section 6 are involved, each for its own function and bound by contract. Payment providers handle card data directly; Fluye never stores it. We will update this section if the infrastructure platform changes.
3. How we protect data
Encryption. All communication between your browser or application and Fluye, and between Fluye and its partners, is encrypted with TLS 1.2 or higher. Data stored in databases, files and backups is encrypted at rest with industry standards (AES-256 or equivalent). Encryption keys are managed in dedicated services, with periodic rotation and restricted access.
Separation between clients. Each company's data is logically separated. A company can only see its own operations and what its counterparties share with it in a specific transaction. No client can access another's history or score.
Backups. We make automatic, encrypted backups at least daily, stored in a location separate from production. We test restoration periodically. Backups are kept for as long as needed to recover the service and meet legal retention periods.
Minimisation. We collect and keep only the data we need. Data that is no longer needed is deleted or anonymised in accordance with the Privacy Policy.
Secrets and credentials. System credentials, API keys and integrations with banks and partners are kept in secret managers, never in code or shared documents, and are rotated when the people with access change or upon any suspicion.
4. Access and identity
Your account. Access to Fluye requires a username and password with minimum complexity requirements, and we offer two-factor authentication, mandatory for users who approve payments or administer the account. Sessions expire after inactivity and you can close all active sessions from the platform.
Roles and permissions. Each company defines who can view, create, approve or collect. Permissions are assigned by role (administrator, sales, collections, operations, read-only) and every relevant action is logged with user, date and origin.
Access by the Fluye team. Our staff access production systems only when their role requires it, with named accounts, two-factor authentication and minimum permissions. Access to client data for support requires a recorded reason and is audited. We review access at least quarterly and remove it on the same day a person leaves the team or changes role.
Confidentiality. All staff and contractors with access to data sign confidentiality agreements and receive security training when they join and periodically thereafter.
5. Secure development and operations
- Change control. Every code change is reviewed by another person and passes automated tests before reaching production. Development, test and production environments are separate and real client data is not used in testing.
- Dependencies. We monitor known vulnerabilities in the libraries we use and apply critical patches promptly.
- Logging and monitoring. We log access, errors and security events centrally, with alerts on anomalous behaviour (repeated failed login attempts, access from unusual locations, atypical operation volumes).
- Security testing. We carry out security reviews on an ongoing basis and assess the platform when there are major architectural changes. We fix findings according to their severity.
- Availability. The platform is designed to tolerate failures of individual components, with redundancy in critical services and a continuity plan that we test periodically. We publish the service status and give advance notice of scheduled maintenance.
6. Integrations with banks, insurers and providers
Fluye exchanges information with partners to process payments, enable coverage and financing and verify identities. Every integration follows these rules:
| Rule | What it means |
|---|---|
| Encrypted and authenticated channel | TLS connections with mutual authentication or signed API keys; no exchanges by email or manual files |
| Minimum necessary | Each partner receives only the fields defined in the agreement for its function; nothing more |
| Traceability | Every send and receipt is logged: what was shared, with whom, when and for which operation |
| Security agreement | Each partner is contractually bound to protect the data, use it only for the agreed purpose and report incidents |
| Review | We assess each partner's security before integrating it and review it when the integration changes |
Payment and disbursement operations are executed by the partner bank on its own systems. Fluye instructs and reconciles, but does not hold funds or store clients' banking credentials.
7. Incident management
A security incident is any event that compromises or may compromise the confidentiality, integrity or availability of data or of the service. We have a documented procedure that we follow in four steps:
- Detection and containment. Automatic alerts and reports from the team or clients trigger the response. First, we isolate the problem so that it does not spread.
- Assessment. We determine which data and which clients are affected, the cause and the risk to individuals.
- Notification. If the incident affects personal data or may harm our clients or their counterparties, we notify them without undue delay, with a clear description of what happened, the data involved and the measures we recommend. We also notify the competent authority in each country within the deadlines set by law (in Qatar, the NCSA). We also inform the partners whose integration is involved.
- Correction and learning. We resolve the root cause, document the incident and adjust controls so that it does not happen again.
We do not hide incidents or downplay their scope. If your company is affected, you will have the information you need to take your own measures.
8. Your part as a client
The security of your account also depends on how you use it. We ask you to:
- Enable two-factor authentication for all users in your company, not only those who approve payments.
- Give each person their own user, with the minimum role they need, and remove access on the day they leave the company.
- Not share passwords or session links, and use passwords different from those of other services.
- Always verify your counterparties' bank account details through an independent channel before changing them in Fluye. Account-change fraud is the most common type in business-to-business collections and payments.
- Notify us immediately if you suspect unauthorised access, an email impersonating Fluye or a payment link you do not recognise.
Fluye will never ask for your password by email, phone or messaging, or send you links to "confirm" your account outside the platform.
9. Vulnerability reporting, changes and contact
If you find a vulnerability in Fluye, write to us at security@usefluye.com with the details needed to reproduce it. We commit to acknowledging receipt within 3 business days, keeping you informed of progress and not taking legal action against anyone who reports in good faith, without exploiting the flaw or accessing third-party data.
We review this policy at least once a year and whenever our infrastructure, our providers or the law change significantly. We publish the version in force on the website with its date.
Security contact: security@usefluye.com. Last updated: 2 November 2026.