Organization-scoped access
PostgreSQL row-level policies and application permissions restrict covered records to the current organization and authorized roles.
For procurement and data-protection review
Security and data protection for humanitarian operations.
An evidence-based overview of how Humanitarian Ops controls access to organizational and beneficiary information. This page distinguishes product controls from deployment choices, operating procedures and customer responsibilities.
Protected beneficiary fields
Selected identifying fields are stored encrypted and revealed only through permission-aware, logged workflows.
Deployment choice
Managed cloud and scoped self-hosted deployments support different infrastructure and residency requirements.
Verified product controls
Controls grounded in the way the product works today.
Security is layered across the database, authentication, application permissions and selected operational workflows. The descriptions below avoid extending a specific control beyond the records and actions it covers.
Access boundaries
Organization and role context are applied to covered product records and actions.
- Organization-scoped row-level policies restrict access to covered PostgreSQL records.
- Roles and module permissions narrow which tools and actions a user can reach.
- Approval responsibilities can be separated across program, finance, procurement and management workflows.
Authentication and MFA
Authentication establishes the user session before protected application routes become available.
- Authenticated routes are gated before signed-in application content is rendered.
- Users can enrol a time-based one-time-password factor for multi-factor authentication.
- After MFA enrolment, covered protected database and storage access requires completion of the higher-assurance challenge.
Audit and accountability
Selected sensitive actions create traceable records for authorized review.
- PII reveal and beneficiary-erasure events record actor, time, reason and relevant context.
- Selected approval, access and operational workflows retain action history.
- Authorized administrators can use available logs as part of access reviews and investigations.
Control coverage varies by workflow. Audit records are useful evidence, but this page does not describe them as immutable, universal or independently certified.
Sensitive humanitarian data
Protection follows the beneficiary-data workflow.
Beneficiary information receives additional controls because names, identifiers, contact details, locations and protection context can create direct risk for affected people.
- 01
Purpose and consent
Consent history can record method, witness, version and exceptions, while teams remain responsible for a lawful purpose and appropriate notice.
- 02
Protected fields
Names, identifiers, phone numbers, addresses, dates of birth, GPS, notes and household-head names are stored in protected fields using organization-specific key material.
- 03
Controlled reveal
PII reveal requires the relevant permission and a reason; the access event records the user, fields, time and stated purpose.
- 04
Private photos
Beneficiary photos remain in private storage. Viewing requires permission and a reason, uses a short-lived link and creates an access record.
- 05
Individual erasure
An authorized erasure workflow clears identifying beneficiary fields and witness identities while retaining non-identifying operational measures needed for reporting. The action and reason are logged.
Data lifecycle
Retention, individual erasure and organization offboarding are different processes.
Each needs a defined owner, documented scope and an agreed operational or contractual procedure.
Retention requirements
Required periods are reviewed during implementation against program, donor, legal and safeguarding obligations. The customer remains responsible for approving the applicable schedule.
Beneficiary erasure
The in-product workflow addresses an individual beneficiary record. It removes protected identifying fields but intentionally retains non-identifying measures and the erasure audit event.
Organization offboarding
Organization-level export and deletion are handled as a separate, scoped service request. Required data, storage, legal holds, timing and verification must be agreed before action.
Current automation boundaryThe current retention setting records an agreed period; it does not run a scheduled deletion process. No procurement document should treat that setting as automated retention enforcement.
Hosting and residency
Deployment responsibilities are agreed before launch.
The applicable architecture, operating responsibility and data location depend on the deployment selected during procurement.
Managed cloud
United Flows operates the agreed application environment. The hosting location, service boundaries and contractual terms are confirmed for the proposed deployment rather than assumed from this website.
Self-hosted
A self-hosted deployment can be scoped where an organization needs control of its own infrastructure. Infrastructure security, operations, monitoring and recovery responsibilities must be allocated in the implementation agreement.
No named managed-cloud region or residency guarantee is published here. Procurement teams should request the location and responsibility details for their proposed deployment.
Shared responsibility
Technology controls and organizational practice work together.
The exact split is documented for each deployment, but these responsibilities provide a practical starting point for review.
United Flows responsibilities
- Operate the product controls and agreed managed components within the contracted service boundary.
- Configure organization, role and permission structures agreed during implementation.
- Provide available audit and investigation context through authorized support processes.
- Document deployment-specific service, support and data-handling commitments in approved agreements.
Customer responsibilities
- Define lawful purposes, notices, consent practices, retention schedules and legal holds.
- Approve users, roles and access, then review them when staff or responsibilities change.
- Protect managed devices, credentials, local exports and any self-hosted infrastructure under customer control.
- Report suspected incidents promptly without sending beneficiary PII, passwords or secret keys through an initial contact form.
Procurement resources
Give your legal, security and data-protection teams a clear review path.
Approved documents and deployment-specific answers are provided through the existing United Flows contact channel. Requests are kept separate from the sales tier form.
Published policy
Privacy policy
Review the published United Flows privacy information.
Read the policyPublished policy
Terms of service
Review the currently published service terms.
Read the termsAvailable on request
Data Processing Agreement
Request the legally approved DPA for review. No draft agreement is presented as binding website content.
Request the DPAAvailable on request
Security questionnaire
Send your organization’s questionnaire and identify the deployment being considered.
Start a security reviewAvailable on request
Responsible disclosure
Report a suspected vulnerability through the existing public contact channel with the subject “Responsible disclosure”.
Report a security issueAvailable on request
Privacy and data requests
Raise a privacy, data-subject or organization-offboarding request and identify the organization concerned.
Submit a privacy requestReporting a suspected vulnerability
Use the subject “Responsible disclosure” and include the affected URL or component, observed impact and safe reproduction steps. Do not include beneficiary data, passwords, access tokens or secret keys in the initial message. No response-time commitment is made on this page.