Trust & Quality

Standards we work to

OpsSoftFlow's quality and information security systems are designed and operated in line with ISO 9001:2015 and ISO/IEC 27001:2022. We process personal data in compliance with the GDPR.

• ISO 9001:2015: quality management. Our system is designed and operated in line with this standard.
• ISO/IEC 27001:2022: information security management. Our system is designed and operated in line with this standard.
• EU GDPR: we process personal data in compliance with the GDPR.
• WCAG 2.2 Level AA: we design to this accessibility standard.
• OWASP ASVS 5.0: the application security baseline we design our web platforms to.
• EU AI Act: we follow the transparency and AI literacy rules that apply to our AI features.

Quality policy

We build software and websites that do what we promised, on time, and that our clients can rely on every day. Our Integrated Quality, Information Security and Data Protection Policy (IMS-01, version 1.0, 15 November 2026) commits us to:

• understand what each client really needs and agree it in writing before we start;
• plan every project with clear steps, owners and acceptance criteria;
• review and test our work before anything goes live, and only release with the client's approval;
• treat complaints as a chance to improve, and fix the cause, not only the symptom;
• keep our skills current through regular training.

Information security

We protect the confidentiality, integrity and availability of the information our clients trust us with, and of our own systems.

What is in place on this website today:

• pages are served only over HTTPS;
• HTTP Strict Transport Security (HSTS, max-age 15768000, includeSubDomains) is enabled;
• security headers are in place, including a content security policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, Permissions-Policy and Cross-Origin-Opener-Policy. These have been live on opssoftflow.com since 15 November 2026.

CFO Hub, our finance platform, is in pilot (in internal use on sample data). Its security design includes owner approval with a two-factor authenticator code, and an audit log of changes. Bots never approve. The platform never sends payments: payments are approved and signed in the client's bank.

Our policy also commits us to give access only to those who need it, with personal accounts; to report, assess and handle security incidents; and to tell you without undue delay if an incident affects your data.

Data protection and privacy

We process personal data in compliance with the GDPR.

• This website sets no cookies and runs no analytics or tracking scripts. Fonts and files are served from our own site.
• If you contact us, we use your details only to reply and to discuss your request. We do not sell them.
• A data processing agreement is available on request, including the EU Standard Contractual Clauses where they are needed.
• When we work for you, you stay in control of your data. We act only on your written instructions, under that agreement.
• We develop and test with sample data. Real client data is loaded only after the agreement and data terms are signed.
• You can ask to see, correct or delete your data at any time. You can also contact your local data protection authority.

See also our Privacy notice.

Accessibility

We design to WCAG 2.2 Level AA, the standard behind the European accessibility rules (EN 301 549).

• clear structure and headings, so screen readers and keyboards work;
• enough colour contrast and text that can be resized;
• forms with proper labels and helpful error messages;
• layouts that work on phones as well as large screens.

We can provide an accessibility statement for a client project when one is needed.

Secure development

Our Secure Development and Data Handling Statement (SDL-01, version 1.0, 15 November 2026) sets out how we build software. It commits us to:

• include security and privacy needs from the start;
• review data flows, access rights and what could go wrong at the design stage;
• use the OWASP Application Security Verification Standard (ASVS 5.0) as the security baseline we design to;
• keep development, test and live systems separate;
• develop and test with sample data.

How we use AI

AI helps us work faster, but a person is always responsible for the result. Our policy is that:

• we tell users when they are dealing with an AI system, and label AI-generated content where the EU AI Act requires it;
• in AI Book Studio, the author can always see which parts they wrote and which parts AI assisted with;
• client data is never put into AI tools that we have not approved for that purpose;
• we do not use AI to make decisions about people, such as hiring or performance ratings.

Policies

These are the public policies we have adopted. Write to info@opssoftflow.com if you need a copy, a completed security questionnaire, or a data processing agreement.

IMS-01

Integrated Quality, Information Security and Data Protection Policy, version 1.0, 15 November 2026

SDL-01

Secure Development and Data Handling Statement, version 1.0, 15 November 2026

Privacy notice

How this website handles personal data, last updated 3 November 2026. See privacy.html.

Suppliers

For this website and our company email we use one supplier, which we have verified:

• Hostinger — website hosting and company email. The site is served on Hostinger's platform. Mail for opssoftflow.com is handled by mx1.hostinger.com and mx2.hostinger.com.

We have not listed a hosting region here, because that detail is still to be confirmed in our privacy notice. When we work on a client product, any further subprocessors are named in the agreement and data terms.

Security contact and responsible disclosure

The security contact for OpsSoftFlow is info@opssoftflow.com.

If you find a security problem in one of our products or on this website, please write to that address. We will confirm receipt, keep you informed, and credit you if you wish. Please give us a reasonable chance to fix the issue before you publish it.

A machine-readable security contact file is published at https://opssoftflow.com/.well-known/security.txt.

Contact

Questions about quality, security, privacy or accessibility, or need our policies, a completed security questionnaire or a data processing agreement? Write to info@opssoftflow.com.

OpsSoftFlow, 14 Anna Politkovskaya Street, Tbilisi, Georgia

Last updated: 15 November 2026