Access & approvals
Plan roles, permissions and approval workflows around the people operating your platform.
Security & Controls
Control is part of the plan.
Define who can act, what needs approval and how activity is reviewed. Make your operating requirements part of the configuration from the start.
In short
Control comes down to three questions. Who can act? What needs a second approval? And how does activity get reviewed afterwards? Flowmynt treats the answers as configuration you agree at the start, not as settings bolted on once the first payment has already moved.
Checks & evidence
Connect compliance and risk workflows with the records your team needs to review decisions.
Visibility & audit
Bring activity, exceptions and reporting into a traceable operating journey.
Controls are configured around your operating requirements and supported integrations.
Encryption and data handling
How your data is protected, and how little of it we keep.
Security controls are only half the picture. This is what happens to the data itself: how it travels, how it rests, what is stored, who can see it and when it is deleted.
Encrypted in transit
Every connection to Flowmynt uses TLS 1.2 or higher, and browsers are told to use HTTPS only (HSTS). Webhooks from providers and messaging platforms are accepted only when their signatures verify, and callbacks to your systems are signed the same way.
Encrypted at rest
Databases, backups and object storage are encrypted with AES-256 by the managed cloud services they run on, with keys held in the provider's key management service. Application secrets are injected from a secret store at start-up and never appear in code, configuration files or logs.
The minimum data, by design
Each journey has an allow-list of the fields it may store or send, kept in a versioned register that is reviewed at every change. Card numbers never enter the platform: payments are authorised on the provider's own page, and card-number patterns typed into a chat are refused and purged at the door. One-time codes pass through and are never stored.
Who can see it
Operator access is role-based with least privilege and multi-factor authentication, and operational views are read-only. Every gate decision and state change is written to a hash-chained audit trail that can be verified at any time, so a change that bypassed the software would show.
Analytics without identities
Reporting runs on pseudonymous events: a salted hash of the customer reference, an amount band and a timestamp. Names, phone numbers and message text never reach the reporting store.
Retention, deletion and residency
Retention periods are agreed per customer in the data processing addendum and enforced by time-limited stores that expire automatically, with deletion on request inside the agreed period. Data is held in the region your regulator requires, or inside your own infrastructure when policy demands it.
Backups and recovery
Point-in-time backups are taken continuously and restores are rehearsed on a schedule, with the audit chain verified after every rehearsal. The rehearsal results are part of the health report you receive.
Incidents and sub-processors
Security incidents affecting your data are notified within the period in the addendum, with the facts known at the time and a full report afterwards. Sub-processors are listed in the addendum and changes are notified in advance.
These describe how Flowmynt is built and operated. Independent certification status is confirmed with current evidence during due diligence rather than claimed on this page.
Read the data processing addendumCommon questions
How are permissions and approvals configured?
Access defines who can act on what, and approval rules define which actions need a second pair of hands before they apply. Both are part of the configuration you agree at the start rather than settings bolted on after go-live.
How does Flowmynt encrypt and handle data?
Every connection uses TLS 1.2 or higher and stored data, backups included, is encrypted with AES-256 through the managed cloud services it runs on. Each journey stores only an allow-listed set of fields, card numbers never enter the platform, one-time codes are never stored, and retention periods from the data processing addendum are enforced by stores that expire automatically.
What security certifications does Flowmynt hold?
Certification status is confirmed directly during commercial and security due diligence rather than stated on this site, so that any certification claim you rely on comes with current evidence attached. Raise it through the contact form and it will be addressed in writing.
Build the money movement platform your business actually needs.
Start with what you need today. Add more as your markets, products and operations grow.