Trust & security
Enterprise standards. Looked after with care.
You are trusting us with your website, your data and the running of your business. Here is how we keep it safe, available, and yours.
Where your data lives
Hosted on enterprise-grade infrastructure, encrypted in transit and at rest.
Coreflow Operations
Microsoft Azure · London & Cardiff (UK)
If you choose to run Coreflow Operations, your operational data is held on our own Microsoft Azure servers in London (Azure UK South), with backups in Cardiff (Azure UK West). It stays in the UK.
Coreflow AI
United States · IDTA + GDPR safeguards
Coreflow AI runs on enterprise-grade infrastructure in the United States, wrapped in an International Data Transfer Agreement (IDTA) and GDPR safeguards that keep it aligned with UK data protection rules. Where data is processed outside the UK, those protections travel with it.
Transparency
The providers behind the platform
You are trusting us with your data, so here is every provider that helps run Coreflow, what each one does, and where your data is processed. You own your data throughout.
Our full Data Processing Agreement, sub-processor detail and international transfer mechanisms are available on request.
Secure, backed up, and yours
Your data is yours
You own your data. You can export it and take it with you whenever you want. No lock-in.
Cyber Essentials
We are Cyber Essentials certified and currently working towards Cyber Essentials Plus.
Encrypted
Data is encrypted in transit and at rest on enterprise-grade infrastructure.
Daily backups
Your data is backed up once a day and retained for 14 days.
Support that scales with you
Three levels of support, same hours, faster response. 9am to 5pm, Monday to Friday, excluding bank holidays.
Basic
Included free
- Best endeavours response
- AI assistant, Portal and Email
Premium
Faster response
- Within 4 hours
- Plus Teams and Phone
Premium Plus
Fastest response
- Within 2 hours
- Plus Teams and Phone
Full support detail, including service credits, is on the pricing page.
Our platform SLA
When something genuinely breaks, here is how fast we move on it. Targets apply within support hours, 9am to 5pm, Monday to Friday, excluding bank holidays.
Documentation on request
Whatever your due diligence needs, we can provide the paperwork. Just ask.
Trust, security and support, answered
Data and hosting
Where is my data hosted?
If you choose to run Coreflow Operations, it is hosted on our own Microsoft Azure servers in London (Azure UK South), with backups in Cardiff (Azure UK West), so your operational data stays in the UK. Coreflow AI runs on enterprise-grade infrastructure in the United States, wrapped in an International Data Transfer Agreement and GDPR safeguards.
Is my data kept in the UK?
If you run Coreflow Operations, yes. Your operational data is held in the UK, on Azure in London with backups in Cardiff. Where data is processed outside the UK through Coreflow AI, those protections travel with it under an International Data Transfer Agreement and GDPR safeguards.
If I use Tribe, where is that data held?
If you use Tribe as your business platform, your customer and application data is stored within the European Economic Area, on Google data centres in the Netherlands (Eemshaven) and Belgium (Saint-Ghislain). It stays in the EEA and is protected under GDPR.
Why is Coreflow AI hosted outside the UK, and is that a problem?
It runs on enterprise-grade US infrastructure, protected by an International Data Transfer Agreement and GDPR safeguards that keep it aligned with UK data protection rules. We are happy to walk your compliance team through the detail.
Who owns my data?
You do. It is your data, always.
Can I get my data out, or is there lock-in?
No lock-in. You can export your data and take it with you whenever you want.
Security and compliance
Is my data encrypted?
Yes. Data is encrypted in transit and at rest on enterprise-grade infrastructure.
Are you certified?
We are Cyber Essentials certified and currently working towards Cyber Essentials Plus.
How do you protect against data loss?
Your data is backed up once a day and retained for 14 days.
Is Coreflow GDPR compliant?
Yes. We can provide GDPR documentation, a Data Processing Agreement and, for US-hosted services, an International Data Transfer Agreement.
Can you provide compliance documentation?
Yes. GDPR documentation, a Data Processing Agreement, an International Data Transfer Agreement and our Cyber Essentials certification are all available on request.
Reliability and support
What happens if the platform goes down?
Genuine platform issues are handled to a published SLA, prioritised by severity. A Critical issue, platform down with no workaround, gets dedicated engineering priority during support hours until a stable fix or workaround is deployed.
How quickly do you respond to issues?
By severity, from within the hour for a Critical issue down to a couple of business days for minor ones, all within support hours. The full targets are set out in our SLA.
What support is included?
Every plan includes Basic support free: the AI support assistant, portal and email, a library of how-to content, advice and signposting, and resolution of genuine platform bugs. Premium and Premium Plus add faster response and more channels.
What are your support hours?
9am to 5pm, Monday to Friday, excluding bank holidays, across all support levels.
Switching to Coreflow
What about migrating my website and data?
No drama. With AI helping us, we migrate your website and data as part of implementation, faster and more cleanly than the usual switchover.
Will I lose data or history when I move?
No. Records are mapped properly, and your links, contacts and past activity come across with you.
Anything else you need to see?
If your compliance team has questions we have not answered here, tell us what you need and we will send the paperwork or walk them through it.
Would rather skip the form? Book a chat →
No obligation. 15 minutes. No slides.