Security & trust

How payments work

When someone buys an event ticket through Flok, they are redirected away from Flok entirely to a checkout page hosted by the club's own Stripe or Payrexx account. Flok's page never renders a card number field, a CVV field, or any other cardholder-data input — there is no iframe carrying a payment form either. The buyer types their card details directly into Stripe's or Payrexx's own page, on their own infrastructure.

Once payment completes, the buyer is sent back to Flok — but Flok doesn't just trust that redirect. A server-side step independently re-confirms the payment with the provider's own API before a ticket is issued. For Payrexx specifically, whose webhooks carry no signature, this re-verification is not optional: Flok never acts on a webhook payload alone.

Because no cardholder data ever reaches Flok's browser code or server code, every club selling tickets through Flok qualifies for SAQ A — the shortest PCI DSS self-assessment available, reserved for merchants using a fully outsourced, redirect-only payment page. See the responsibility matrix below for the detail, and our tenant PCI guide for what that means for you as an organiser.

Subprocessors

Everyone who touches Flok data or infrastructure on our behalf, and why. DPA means a data processing agreement is in place; SCC means the transfer additionally relies on the EU Standard Contractual Clauses, because the processing happens outside Switzerland and the EEA.

Provider	Purpose	Location	Certifications	Agreement
Infomaniak (Infomaniak Network SA)	Pilot AI features — drafting, matching, summarising and reading a photographed receipt, with a human approving before anything sends, charges or is booked; also the public support assistant on event pages. Requests are not stored or logged.	Switzerland (Infomaniak's own data centres)	ISO 27001:2022, ISO 9001, ISO 14001, ISO 50001	DPA
Vercel	Static site hosting, object storage (encrypted backups), cookieless web analytics	Frankfurt, DE (eu-central-1)	Publishes its own SAQ-D AoC and a customer responsibility matrix via its Trust Center	DPA
Supabase	Database, authentication	Zürich, CH	Per Supabase's own published certifications	DPA
Stripe (club's own account)	Payment processing on each club's own connected Stripe account. The club is Stripe's customer; Flok facilitates a full-redirect connection and no cardholder data touches Flok.	Per club's Stripe account	PCI DSS Level 1 Service Provider	DPA
Stripe (Flok's own billing)	Flok's own merchant account, used to collect Flok subscription fees from club administrators. Here Flok is Stripe's customer, and Stripe processes administrator name, email address, payment method and billing address on Flok's behalf.	Flok's Stripe account	PCI DSS Level 1 Service Provider	DPA
Payrexx	Payment processing (each club's own connected account) — tenant-held contracts only	St. Gallen, CH	PCI DSS Level 1 Service Provider	DPA
Resend	Transactional email, newsletter delivery	Ireland, EU (eu-west-1)	See Resend's own documentation	DPA
Sentry	Error tracking (no cardholder data; scrubbed of common PII patterns)	Germany, EU	Per Sentry's own published certifications	DPA

The same list is published as Annex 1 to our Data Processing Agreement, generated from the same record so the two can never disagree. We give at least 30 days’ notice before adding or replacing a subprocessor.

Data residency

Member and club data lives in Flok's Supabase database in Zürich, Switzerland. Static assets and encrypted backup files are stored in Frankfurt, Germany. Both locations are within the scope of the Swiss Federal Act on Data Protection (nDSG) and the EU GDPR. Cardholder data never reaches either location — see How payments work.

AI features stay in Switzerland too. Text sent to Flok Pilot or the public support assistant is processed by Infomaniak in its own data centres in Switzerland, and Infomaniak does not store or log those requests. Each Pilot feature can be turned off individually; a feature that is off sends nothing.

Backups

Backups run in two independent tiers, because they protect against different things.

Long-retention archive. The database is dumped twice daily, GPG-encrypted before it ever leaves the backup job, and stored in a private object store at a different provider from the primary database — so a problem with one doesn't take out the other. Kept for at least 60 days, then pruned automatically. The private decryption key is held offline and is never stored in the CI system that creates the backups.
Fast recent restore. Our database provider takes its own daily backups with 7-day retention, alongside the database, for quick recovery to a recent point.

The restore process is a documented, tested procedure — including specific issues found and fixed during a real restore run, not just a description of how it's supposed to work.

Authentication

Members authenticate with a passwordless one-time code sent to their email — no password to reuse or leak. Codes are valid for 10 minutes and lock out after 5 incorrect attempts. Club staff and admin accounts can additionally use WebAuthn passkeys — hardware-backed, phishing-resistant login.

Flok stores no passwords and no password hashes anywhere. Passkeys are available to staff and admin accounts, and are deliberately not enabled on the member portal.

Shared responsibility matrix

Who owns what, requirement by requirement — the payment provider, Flok, or you as the club.

Download as PDF ↓

Requirement	Provider	Flok	You (tenant)	Notes
Loading…

Agreements & annexes

Certifications held by our providers

Flok does not hold these certifications itself — they belong to the providers listed above, who each publish and maintain their own attestations:

What Flok does not claim. Flok has not itself completed a PCI DSS assessment, and has not undergone a SOC 2 or ISO 27001 audit. We don't need to hold cardholder data to run Flok, so we've built the product to avoid that scope entirely rather than take on the assessment burden of handling it — every requirement in the matrix above that Flok would otherwise own is instead inherited from Vercel or Supabase, both of which are independently certified. If you need a specific attestation about Flok itself for your own procurement process, email security@getflok.app and we'll tell you plainly what we do and don't have.

Security contact

Found a security issue, or think you have? Email security@getflok.app. We commit to acknowledging a genuine report within 2 business days and will keep you updated as we investigate and fix it. Please report privately rather than opening a public issue, and give us a reasonable window to fix something before disclosing it — we won't take legal action against good-faith security research conducted this way.

If we become aware of a personal data breach affecting data we process for your club, we will notify you within 48 hours — see section 8 of our Data Processing Agreement.