Trust & Security
GlooFloo protects organization data through system-level isolation, multi-layer authentication, and a full audit trail for every change.
Each organization’s data is fully isolated from other organizations at the system level, not just at the interface level. Any attempt to access another organization’s data is rejected without even revealing that the data exists.
Authentication methods: two-factor authentication (MFA), passkeys, and enterprise single sign-on (SSO).
Identity management and sync: the SCIM protocol manages and automatically syncs user identities with your organization’s systems.
Every significant change in a workspace is logged, with privileged administration actions recorded separately in a dedicated audit log.
Workspace data can be exported at any time, through protected export links that expire automatically. Before any final deletion, GlooFloo honors legal hold requirements so that data subject to regulatory retention is never deleted unintentionally.
GlooFloo’s AI assistant suggests actions based on plan context, but no action runs without your team’s explicit approval; every suggestion goes through approval controls before it’s applied.
On the standard cloud service, data is currently stored outside Saudi Arabia. For government contracts, a full system implementation is carried out either on the government entity’s own servers or on local Saudi hosting, to keep data within the Kingdom.
Planned · no audit has started
GlooFloo currently plans to pursue SOC 2 and ISO 27001 certifications, along with compliance with Saudi Arabia’s Personal Data Protection Law (PDPL).
