Dynafloxis compliance evidence

Repo-verified gates

3/5

Security, reliability, and core product-release evidence are checked into the repo and guarded by CI.

Open external approvals

4

These are the remaining items that cannot be truthfully closed by code changes alone.

Public evidence surfaces

6

Each public page points back to a repository-backed source-of-truth document.

Vendor and transfer evidence

Dynafloxis uses controlled subprocessors for database, queueing, storage, billing, and transactional email. Each vendor needs an explicit data-transfer record, region note, and contract reference.

Retention and deletion

The platform now enforces retention cleanup for deleted users, notifications, support tickets, audit logs, and other operational records. Legal hold and configurable per-org retention are still open work.

Incident response

The codebase includes health checks, metrics, and audit logs, but the incident workflow still needs alert routing, ownership, notification templates, and evidence handling.

DPIA and risk review

Process mining, tenant administration, support tickets, and billing data all require explicit privacy-risk review before large-scale deployment or major feature expansion.

Security and access control

Privileged actions now require MFA step-up in the API. The remaining work is policy-level hardening: role matrix, secret handling, incident response, and external verification.