Your customers' data is the most sensitive thing you'll trust to a collections supplier. This page sets out how we protect it, who checks our work, and what to ask for when your team runs due diligence.
Request our security pack
Certified by BSI since 2020. The certification covers the whole organisation, not just the software. Certificate IS 719933, valid to April 2029. You can verify it on the BSI client directory.
Compliant through SAQ D for Service Providers, reviewed annually by an independent Qualified Security Assessor. Flexys doesn't store or process card data. Payments pass encrypted to the card payment processor, and we work with a number of processors depending on the client. The current Attestation of Compliance is available on request.
Registered supplier on Hellios FSQS, the supplier qualification system used by UK banks and building societies. Supplier ID 10037800. If your procurement team uses FSQS, our due diligence is already on file.
Our software and infrastructure are penetration tested every year by Cyberis, a CREST-accredited independent tester. Findings are remediated and retested, and a summary letter is available to prospects under NDA. Network vulnerability scanning is carried out by Qualys.
Our infrastructure and network are monitored continuously by SPG Intelligence, a UK-based managed security provider. Monitoring covers threat detection, endpoint protection, privileged access and network anomalies, with proactive threat hunting and monthly security maturity reviews. Our controls are assessed against ISO 27001 on an ongoing basis, not just at audit.
Continuous
Security monitoring
Threat detection
Endpoint protection
Threat hunting
ISO 27001 control monitoring
Monthly
Security maturity review
Threat landscape report
Service review
Quarterly
Compliance audit
Detection rule tuning
Annually
Penetration test (Cyberis, CREST)
PCI DSS assessment (independent QSA)
BSI surveillance audit
Business continuity and disaster recovery test
Every three years
ISO/IEC 27001 recertification
Certified since 2020
Current certificate valid to April 2029
Flexys is hosted on Google Cloud in London. Data is encrypted in transit and at rest. All administrative access requires multi-factor authentication, and there's no single-factor access anywhere in the environment. Google Cloud's data centres carry Google's own certifications, including ISO 27001, 22301, 27017 and 27018, which cover the physical and infrastructure layers. Everything above that layer, from network controls to application security, is ours to manage and ours to answer for.
Flexys processes personal data under UK GDPR as a processor on behalf of our clients. Data processing terms are part of every contract.
Flexys runs on Google Kubernetes Engine using regional clusters, so the control plane is replicated across multiple availability zones and workloads restart automatically if a zone fails. Databases and messaging run as high-availability services across three zones. Region-level standby can be provided as a contractual option for clients who need it.
Our business continuity and disaster recovery plan is tested every 12 months. Flexys is a remote-first company, so a site incident doesn't interrupt service, and every critical operational role has a named deputy.
Information security management system (ISO/IEC 27001:2022)
Flexys, certified by BSI
Penetration testing and vulnerability scanning
Cyberis and Qualys
Continuous security monitoring and threat hunting
SPG Intelligence
Application security, access control and encryption
Flexys
Network controls, firewalls and MFA-protected administration
Flexys
Physical data centre, London
Google Cloud
Five consecutive years of independent approval from Arum, the UK's collections and recoveries consultancy.
Best Use of Technology, with Water Plus.
Shortlisted for Best Use of Technology and for Customer Engagement Solution, both with Plata. Winners are announced in November 2026.
Most security questionnaires can be answered from documents we already hold. On request, we'll provide:
On Google Cloud in London. It doesn't leave that region unless you ask us to configure otherwise.
No. Card payments go directly to the card payment processor. Flexys never stores or processes card numbers.
You do. Flexys is a data processor. We act only on your instructions, and data is returned or deleted at the end of a contract on your terms.
Penetration tested annually by an independent CREST-accredited tester, monitored continuously by SPG Intelligence, and audited by BSI under a three-year ISO 27001 certification cycle with annual surveillance visits.
Yes. We hold standard responses for the common formats and can complete bespoke questionnaires on request.
Flexys runs across multiple availability zones, so a single zone failing causes at most a brief interruption while workloads restart elsewhere. Our business continuity and disaster recovery plan covers wider failures and is tested every 12 months.