How we keep it safe
Last updated: 7 September 2026
Letting customers build inside your product only works if nothing they build can ever put you at risk. This page covers how we make sure of that, and the security behind the platform underneath it.
1. Kept safe by default
Every single thing a customer builds passes through the same set of checks before it goes live, with no exceptions:
- •Always on brand: it's built to match your product automatically, nobody has to check it
- •Off until you switch it on: nothing is available until you turn it on, one thing at a time
- •Locked to their own data: one customer can never see another's information
- •Only reaches what you approve: it can never connect to a system you haven't allowed
- •Always undoable: every change is saved as a version you can roll back
- •Costs stay capped: you set the limit on what any customer's builds can cost
2. Encryption
Everything sent between your product and ours, and everything we store, is encrypted using industry-standard methods (TLS 1.3 in transit, AES-256 at rest).
While it's moving
- •Encrypted connections for all traffic
- •Extra checks on every connection to guard against impersonation
- •Encrypted uploads for any files a build touches
While it's stored
- •Strong encryption for everything we store
- •Encrypted backups
- •Secure key management and rotation
3. Kept separate from your real systems
Every build runs in its own safe space, walled off from your production systems and from every other customer:
- •Its own space: each build runs in a contained environment of its own
- •Network defences: firewalls, attack protection, and intrusion detection
- •Locked-down access: multi-factor login and access based on role
- •Kept up to date: security patches applied automatically
- •Watched around the clock: continuous monitoring for anything unusual
4. Who can access your data
We keep tight controls on who at Floka can see your data:
- •Multi-factor login required for every staff account
- •Staff only see what they need for their role, nothing more
- •Regular reviews of who has access to what
- •Every access to your data is logged
- •Access is removed immediately when someone leaves
5. How we handle your data
We keep the same principle throughout: collect less, share less, and delete it when it's no longer needed.
- •Minimal by default: we only collect what our services actually need
- •No crossover between customers: one customer's data is never visible to another
- •Only what you allow: a build only ever sees the data you've explicitly given it access to
- •Securely deleted: data is removed for good once it's no longer needed
6. The tools we rely on
When we bring in another company to help run the platform, we hold them to the same standard:
- •Every provider is checked for security before we use them
- •Written agreements with strict confidentiality requirements
- •Regular re-checks of their security
- •We only use providers that meet UK GDPR, and are UK-based where possible
7. If something goes wrong
We have a plan in place to respond quickly to any security issue:
- •Continuous monitoring and alerts
- •A defined response plan, not made up on the day
- •Immediate containment and investigation
- •Affected customers told, as required by law
- •A review afterwards to close the gap for good
8. Where we stand legally
- •UK GDPR: fully compliant with UK data protection law
- •Data Protection Act 2018: compliant with UK data protection legislation
- •Company registration: Managed Labs AI Ltd (company number to be added on incorporation)
9. What you can do to help
- •Use a strong, unique password for your dashboard account
- •Never share your login with anyone
- •Take a look before you switch on anything new for your customers
- •Tell us straight away if anything looks off
10. Questions about security
If you have questions about how we keep things safe, or want to report a concern, get in touch:
Floka Security
Email: hello@floka.co.uk
Managed Labs AI Ltd
For general privacy inquiries, see our Privacy Policy.