Security and evidence.
What procurement, data protection, IT security and the works council want to know, in one place, so that you do not have to ask first.
Certifications
- ISO 9001:2015 for quality management and ISO 27001:2022 for information security, externally certified
- Certificate register no. 260508 8 IMS
- The scope covers the development and operation of our own HR tech platforms, end-to-end HR IT solutions and consulting across the whole HR IT life cycle
Reviewed by large groups
- Provider security reviews (IT security self-assessments) by DAX-listed groups passed
- Technical and organisational measures as a contract annex
- A transfer impact assessment as a contract annex
- A framework agreement for software provision (ASP/SaaS) established in a large group
Hosting and where the data sits
- Operated in Germany, exclusively within the EU
- Contracts under German law, support in four languages, Mon to Fri from 9 to 17 CET
- Tenant separation: the data of different customers is logically separated
- Regular penetration tests by external auditors
- Backup and recovery are settled in the contract
- Report security incidents to support@flynne.de
Data protection from the start
- A data processing agreement under Article 28 GDPR
- Access links instead of candidate accounts: applicants create no account and no password
- Documented deletion concepts with periods per type of data
- Separation from the applicant tracking system: flynne holds only what the procedure needs
Time-controlled access
- Psychologists see candidate documents only three days before the appointment
- Assessors only five days beforehand, and only after confirming their impartiality
- These periods are our standard profile and are set to your rules during setup, whether from a works agreement, a data protection concept or established practice
- Role-based permissions: each role sees only what its task requires
- Candidate access ends after participation; results are kept for the periods set out below
Evidence
- An audit-proof activity log: every action with person, time and subject
- Evidence for AGG reviews, courts of audit and challenges by unsuccessful applicants
- Standardisation to DIN 33430 built into the tool
Insurance cover
- Professional and general liability insurance, including software and IT services as well as data protection risks
- Cyber insurance
- Legal expenses insurance for companies
- Pecuniary loss liability insurance for the management (D&O)
- Placed with Allianz
Co-determination
- A works council process completed in full in a large group
- Experience of the questions committees actually ask
- Workload is visible; that it is not used to appraise performance is something we commit to contractually
Artificial intelligence
- flynne judges nobody; the suitability decision is always made by a person
- AI works on the organisation, not on the judgement
- Every AI action lands in the same log as every human action
- Our EU AI Act classification has a page of its own
How flynne handles artificial intelligence is set out in full in our AI principles. The processing of personal data is described in the privacy notice.
How a review with us runs
The most common uncertainty in the first contact is not whether we can deliver, but when what arrives.
First conversation
Usually with the department and IT together. Afterwards you know whether flynne fits professionally, and we know which review bodies are involved on your side. Without that information both sides plan at the wrong end.
Questionnaire
You send your InfoSec or provider questionnaire and we fill it in. This round takes us days rather than weeks; we have been through it many times.
Follow-up questions and evidence
Almost always some points remain that no questionnaire covers: a works agreement that requires particular access periods, a retention rule, a special case in tenant separation. We settle those in writing rather than on the phone; they end up in the contract annex.
Contract and setup
What was agreed during the review is configured during setup: access periods, roles, deletion periods, retention. That is the point at which promises become configuration, and the reason we do not leave the review to sales alone.
Who else is involved
The question about sub-processors is in every questionnaire, and vendors like to answer it evasively.
The list is a contract annex
Every service involved in the processing is named in the annex to the data processing agreement, with its location, purpose and legal basis. You receive it before signing, not afterwards.
Inside the EU only
Procedure and candidate data is processed exclusively in the EU. A sub-processor outside the EU would not come into question for that data; that is not an intention but the precondition for the hosting statement to hold.
Changes are announced
If a service is added or replaced, we inform you beforehand and you can object. That is what the data processing agreement says, and what Article 28 GDPR provides for.
What is not part of it
No analytics service that evaluates candidate behaviour. No external service that processes judgements. No provider that uses data for its own purposes or to train models.
What you can rely on
flynne is developed and operated in Mainz, in beautiful Rhineland-Palatinate. You talk to the people who build the system, not to a hotline. And what you can rely on is set out in writing.
Your data is yours
You can request a full export at any time, in open, machine-readable formats. At the end we delete it and confirm that in writing.
Nothing renews itself
A pilot ends after 90 days on its own. A contract only comes about if you sign one.
Audited operation
Brandmonks GmbH, as the operator, is certified to ISO 9001:2015 and ISO 27001:2022, register no. 260508 8 IMS. Operation runs in Germany, exclusively within the EU.
A German contracting party
Contracts under German law, data processing agreement under Art. 28 GDPR. You receive the template before signing.
These commitments also apply to the pilot assessment: one real assessment over 90 days, with no annual commitment. See the pilot assessment
If something happens
No vendor can rule incidents out. What can be checked is what happens then, and in which order.
Who is informed
You as the controller, without delay. That is not goodwill but Article 33(2) GDPR: the processor reports to the controller, and the controller to the supervisory authority. The 72-hour deadline towards the authority runs for you, which is why our report to you comes before our own analysis.
What the report contains
What happened, which types of data are affected, how many people, which immediate measures were taken and what is still open. Even when something is still open: a late complete report is worse than an early incomplete one.
What the log delivers
The activity log shows who saw or changed which data and when. On the question of which individuals have to be informed, that is the difference between an answer and an estimate.
Who the contact is
A named person with a phone number, not a ticket form. During an incident the first question is who you reach, and the second whether that person is allowed to decide.
Questions from procurement
May we audit you?
Yes; Article 28 GDPR provides for it anyway and the data processing agreement governs it. In practice most organisations first ask for the documents and certificates and reserve the right to audit. If you want to carry one out, we agree scope and date beforehand: an unannounced audit in a multi-tenant system would not be possible without touching other customers.
What happens to our data when the contract ends?
You choose between return and deletion; both are governed by the data processing agreement and documented. What matters in practice is the timing: retention duties for selection procedures can reach beyond the end of the contract, for AGG periods or procurement documentation for example. We configure those periods during setup according to your rules, so that they do not have to be negotiated in the final month.
Who on your side can access our data?
Access is role-based and tied to a purpose, for support and operations, and logged like any other access. Access without a reason is not a matter of trust but of configuration, and it is visible in the activity log. The details are set out in the technical and organisational measures.
Is flynne suitable for public tenders?
We can evidence the standard requirements of public procurement: EU operations, a German contracting party, certificates, traceability of procedures, an accessibility statement. For BITV requirements we examine the specific scope case by case; a blanket conformity promise would be dishonest, because it depends on which features were tested.
Ready for assessment days that simply run?
Tell us briefly how you run assessments today. In 30 minutes we will show you how flynne helps.
We reply within one working day.