Security & Data Protection

FlockPack is built on a "Hardened Cloud" foundation, ensuring that your application is always available and protected against external threats.

• World-Class Hosting: We host our services on Google Cloud Platform (GCP), utilising the same physical security and global network safeguards that power the world's largest and most secure organisations.
• Continuous Maintenance: Our underlying infrastructure is continuously monitored and patched. Security updates are applied automatically by Google Cloud, ensuring that protection is never static and system downtime is minimised.
• Global Certifications: Our hosting environment maintains SOC 2 Type II and ISO 27001 certifications, proving that the infrastructure undergoes rigorous independent audits for security, availability, and confidentiality.

Data is protected at every stage of its journey, whether it is being sent across the internet or sitting on our servers.

• In-Transit Protection (TLS/HTTPS): Every connection to FlockPack is encrypted using Transport Layer Security (TLS) 1.2 or higher. This prevents interception as data travels between the user's device and our servers.
• At-Rest Protection (AES-256): All data stored in our databases and all uploaded files (logos, banners) are encrypted using Advanced Encryption Standard (AES-256) at the storage layer.

FlockPack is built as a multi-tenant platform — many organisations share the same software, but data is strictly separated.

• Container Isolation: Each instance of our application runs in a logically isolated environment. This multi-tenant architecture ensures that your organisation's processes are sandboxed from others, preventing cross-application security risks.
• Logical Partitioning: We employ strict database-level filtering. There is no physical way for Organiser A to view or query the data belonging to Organiser B.
• Privacy by Design: This architecture ensures that your member lists, emails, and financial reports remain exclusively yours and are never "mixed" with another organisation’s data.

FlockPack follows the principle of "Outsourced Security" for financial transactions, ensuring we never handle sensitive credit card data directly.

• Stripe Integration: All credit card processing is handled by Stripe, a PCI-DSS Level 1 Service Provider.
• Zero-Knowledge Payments: FlockPack never sees, processes, or stores full credit card numbers or CVV codes. This significantly reduces your liability and removes the risk of financial data theft from our platform.
• Online EFTPOS (Worldline / Paymark): We provide a technical integration for numberless, mobile-to-mobile payments via the Cuscal network. Users verify payments directly within their own trusted bank app; FlockPack never sees or stores bank login credentials.

As a New Zealand-based platform, we are built specifically to align with local privacy standards.

• NZ Privacy Act 2020: FlockPack is designed to be fully aligned with New Zealand's privacy laws.
• Offshore Storage Safeguards: While our primary data processing occurs in secure, Tier-1 global data regions, our operations are fully compliant with Information Privacy Principle 12 (IPP 12). We ensure that all personal information stored offshore is protected by "comparable safeguards" through enterprise-grade encryption and strict data processing agreements that meet or exceed New Zealand standards.

We provide a transparent and permanent process for data removal, ensuring compliance with the Privacy Act while maintaining disaster recovery capabilities.

• Immediate Logical Deletion: When an Organiser deletes an account or event, the data is removed from all active "Live" databases immediately.
• Primary Recovery Window (Granular): We maintain hourly and daily backups for a period of 7 days to allow for Point-in-Time Recovery (PITR) should a critical error occur. Data is purged from this window as the 7-day cycle rotates.
• Archival Backups: For long-term disaster recovery, we maintain weekly and monthly snapshots. Data is fully and permanently purged from these archival cycles as they are systematically overwritten.
• Record-Keeping: In accordance with NZ law, Organisers are responsible for downloading their final Fulfillment Reports (CSV) prior to deletion to satisfy Inland Revenue (IRD) 7-year record-keeping requirements.

Security at FlockPack is a collaborative partnership:

• FlockPack’s Responsibility: We manage the security of the underlying infrastructure, network, and physical servers. We are responsible for the encryption layers, multi-tenant isolation, and the integrity of our automated backup systems.
• The Organiser’s Responsibility: As the primary “Agency” under the NZ Privacy Act, organisers are responsible for maintaining strong account passwords, managing administrative access levels, and ensuring the lawful use of data once it is exported from the platform via CSV.

For specific security queries, please contact support@flockpack.com.