Security

Q: Do clients need a RequestFlow account to upload documents?

No. Clients use the private upload link from the request and can send files without creating a RequestFlow account.

Q: Can request links be protected?

Yes. Sensitive requests can require a PIN before the client opens the upload page.

Q: Are uploaded files scanned?

Yes. Uploads must pass malware scanning before firm users can download or review the file.

Q: Does RequestFlow claim SOC 2, ISO 27001, HIPAA, or GLBA compliance?

No. RequestFlow describes current product controls and does not make third-party certification claims.

How RequestFlow handles client file uploads.

Clients upload documents through private request links without creating accounts.

Your firm can require PINs for sensitive requests, use multi-factor authentication for staff accounts, review upload activity, and download files after scanning.

This page describes product controls available in RequestFlow. It does not make third-party certification claims.

Security controls

ControlWhat it does

Private upload linksEach request has its own client upload link.

Optional PINsSensitive requests can require a PIN before upload.

No client accountsClients do not need RequestFlow logins to send files.

Staff multi-factor authenticationFirm users can protect staff access with multi-factor authentication.

Server-side access checksRequest, file, export, and download actions are checked on the server.

Malware scan before downloadUploads must pass malware scanning before staff can download them.

Short-lived downloadsDownload links are temporary and expire automatically.

Audit historyRequest sends, opens, uploads, downloads, approvals, and reminders are recorded.

Export and delete accessFirms can export files and remove data when needed.

Frequently asked questions

Do clients need a RequestFlow account to upload documents?

Can request links be protected?

Are uploaded files scanned?

Can firm users use multi-factor authentication?

Does RequestFlow claim SOC 2, ISO 27001, HIPAA, or GLBA compliance?

What activity is recorded?

Security documents

Additional pages for firms, clients, and vendor reviews.

Data Processing Addendum

Processing roles and safeguards.

Subprocessors

Hosting, storage, email, billing, monitoring, and support providers.

Data retention

How files, exports, logs, billing records, support grants, and deleted organizations are handled.

Support access

How customer-approved support access works.

Acceptable use

Product boundaries and abuse reporting.

Security contact

Responsible disclosure and urgent security questions.