Trust is demonstrated, not declared.
Certification, self-assessment and technical evidence are different things, and this page never calls one by the name of another.
References and assessments
Each item below says what it is. A self-assessment is not a certification, a technical reference is not a badge, and an external rating is continuous measurement, not an audit.
CSA STAR Level 1, self-assessment
In preparationWe are answering the Cloud Security Alliance CAIQ questionnaire, based on the Cloud Controls Matrix, for publication in the public STAR registry. It is a transparent self-assessment of our controls, not an audited certification, and that is what we call it.
OWASP ASVS 5.0 as technical reference
In useOur security program uses the Application Security Verification Standard as its checklist for development, code review and testing. OWASP does not certify vendors, and we do not claim otherwise: the standard is our internal ruler.
External security rating
In preparationContinuous monitoring of our domain by an independent assessor, with the external score available to customers who request it.
Today we do not hold our own ISO 27001 or SOC 2 certification. When we do, it will be on this page with the corresponding report. Until then, we publish what can be verified.
Responsible disclosure
Found a vulnerability? Write to security@flunora.com. We reply within 5 business days and take no legal action against good-faith research.
Data protection and documents
The full documents are public: