Where mdflows stands on compliance

Security assurance

Independent reports and the questionnaires security teams send.

• SOC 2

  Preparing

  We do not have a SOC 2 report yet. We are preparing for a SOC 2 Type I audit, with our controls mapped to the AICPA Trust Services Criteria, and will publish the audit date here once it is scheduled. Type II follows Type I.

• HECVAT

  On request

  We complete the EDUCAUSE Higher Education Community Vendor Assessment Toolkit (HECVAT 4) for colleges and universities.

• CAIQ and other questionnaires

  On request

  We answer the Cloud Security Alliance CAIQ and your organization’s own security questionnaire.

• Penetration testing

  Not yet

  No third-party penetration test has been published yet. Our security overview lists every control and how it is enforced.

• ISO/IEC 27001

  Not pursued yet

  We are pursuing SOC 2 first. Our infrastructure provider, Cloudflare, is certified to ISO/IEC 27001:2022.

Privacy and data protection

For the content your organization collects, mdflows acts as a processor (a service provider) on your instructions. See the privacy policy and the subprocessor list.

• GDPR and UK GDPR

  In progress

  A data processing agreement with the EU Standard Contractual Clauses and the UK Addendum is being prepared with counsel. mdflows Cloud does not yet offer EU-only data storage; for data that must stay in one place, mdflows On-Premises runs on your own servers.

• CCPA and CPRA

  In progress

  We do not sell or share personal information. Service-provider contract terms come with the data processing agreement above.

• FERPA

  In progress

  Colleges designate service providers as school officials by contract. Our education terms — direct control, use limits, no redisclosure — are being prepared with counsel.

• HIPAA

  Not supported

  We do not sign business associate agreements, so mdflows Cloud must not hold protected health information.

Electronic signatures

Every signature records the signer’s identity, intent, time, network address and browser, and a SHA-256 fingerprint of exactly what was signed, sealed into the tamper-evident audit log.

• ESIGN Act and UETA (United States)

  In place

  Signers state their intent before signing, each signature is attributable to its signer, and the signed record keeps its evidence and a Certificate of Completion. mdflows does not yet show the separate consumer consent disclosure a law sometimes requires when information must reach a consumer in writing; send those documents another way for now.

• eIDAS (European Union)

  Simple signatures

  mdflows signatures are simple electronic signatures, which eIDAS admits as evidence. They are not advanced or qualified electronic signatures; documents that need those require a qualified trust service provider.

• 21 CFR Part 11

  Not validated

  mdflows is not validated for FDA-regulated electronic records.

Accessibility

Public forms, signing pages, reviewer pages and admin pages are checked against WCAG 2.1 Level AA on every build; a new violation fails the build like a failing test.

• WCAG 2.1 AA and Section 508

  In progress

  An Accessibility Conformance Report in the VPAT® format is being completed with manual testing; until it is ready, the automated checks above are our evidence.

Payments

Subscriptions are paid through Stripe Checkout, a payment page hosted by Stripe.

• PCI DSS

  Out of scope by design

  Card details go straight to Stripe, a PCI DSS Level 1 service provider, and never reach mdflows. Forms built on mdflows must not collect card numbers.

Government programs

Agencies with these requirements can run mdflows On-Premises inside their own environment.

• GovRAMP (formerly StateRAMP), TX-RAMP, FedRAMP

  Not authorized

  mdflows Cloud holds none of these authorizations.

• CJIS

  Not supported

  mdflows Cloud must not hold criminal justice information.

The infrastructure underneath

mdflows Cloud runs on Cloudflare, and payments run on Stripe. Each holds its own independent reports, which cover the infrastructure layer — not mdflows itself.

Cloudflare

SOC 2 Type II (Security, Availability, Confidentiality), ISO/IEC 27001:2022 and ISO/IEC 27701. Its reports cover the Workers, D1 and R2 services mdflows runs on. See Cloudflare’s compliance resources.

Stripe

PCI DSS Level 1 service provider, assessed annually, with SOC 2 Type II reports. See Stripe’s security page.

More

• Security overview — how mdflows protects your records, in plain language.
• Subprocessors — who processes customer data for mdflows Cloud.
• Report a vulnerability — also published at /.well-known/security.txt.