Security & Compliance

Scope. This page summarizes the security posture of the Flashduty service, which currently operates as a single service hosted in mainland China, developed and operated by 北京快猫星云科技有限公司 (Beijing Flashcat Cloud Technology Co., Ltd.) — the holder of the certifications and publisher of the protocols linked below.

Everything on this page is drawn from the binding documents linked in the final section. Where a figure or certificate number appears here, it can be verified against the issuing authority.

Certifications

Both certificates were issued to 北京快猫星云科技有限公司 (unified social credit code 91110108MA04GCEE4H) by Hua Nuo Xin He of Beijing Certification Co., Ltd., accredited by CNAS (registration C338-M) under the IAF Multilateral Recognition Arrangement. Certificate validity can be checked with the certification body or through the national certification database at cnca.gov.cn.

We state the certified scope explicitly rather than claiming blanket certification, because scope is what a certificate actually asserts.

Your data belongs to you

Data you process, store, upload, or otherwise handle through the service is your business data, and you own it outright. We do not use or disclose it beyond what is needed to deliver the service you have requested, except where disclosure is legally compelled or separately agreed with you.

Without your authorization we do not access the content you store in the service. With your prior authorization — for example, when you ask for help diagnosing a problem — we may access it to support you.

How the platform protects data

The Data Protection Protocol commits to the following measures:

• Encryption in transit — customer data is transmitted using secure encryption protocols.
• Encryption at rest — stored customer data is encrypted, where applicable.
• Access control — strict access controls limit customer data to authorized personnel.
• Security audits — regular audits assess and improve the effectiveness of these measures.
• Physical security — physical measures protect the servers and facilities that store customer data.
• Vulnerability management — regular vulnerability scanning and remediation.
• Disaster recovery — data backup and disaster recovery mechanisms for events such as data loss.

Employees who process customer data receive confidentiality and security training.

Where data is stored, and cross-border transfer

Flashduty currently operates as a single site hosted in mainland China. All customer data is stored on servers in mainland China that meet applicable regulatory requirements — regardless of where you are located.

We do not transfer customer data outside mainland China unless you have explicitly agreed or the law requires it. Where a cross-border transfer is necessary, we comply with the applicable Chinese laws, apply the necessary safeguards, and inform you and obtain your consent in advance.

If we launch additional regional sites in the future, data for each site will be stored in that site's region, and this page will be updated accordingly. If your deployment has particular data-residency requirements, contact us before you buy so we can confirm what is available for your region.

Availability commitment

The service level agreement commits to:

• 99.9% availability of core features, measured as an error rate over five-minute cycles.
• 99.9% of alerts delivered within five minutes of triggering.

A five-minute cycle counts as failed when either the error rate or the delivery-delay rate reaches 0.1%. The service period for calculation is 30 days. When a commitment is missed, compensation is issued as service credit, calculated as minutes below commitment × per-minute rate of the monthly service fee × 10, capped at that month's fee; claims are made in the two months following the affected month.

The SLA excludes announced maintenance windows, failures in equipment or networks outside our control, compromise of your own application or credentials, misconfiguration on your side, carrier or handset delivery problems, and force majeure. Beta, invitation-only, and free features are outside SLA scope, as is the on-premises version.

If a breach occurs

In the event of a customer data breach we notify affected customers within a reasonable time and provide detail on what was exposed, the potential impact, and the remedial steps taken or planned. We cooperate with customers investigating an incident and report to regulators where the law requires it.

Retention and deletion

When your service ends, your business data is retained only for the buffer period stated in the terms applicable to the product you ordered. After that period we delete all of it, including cached and backup copies, and retain none of it. Deletion is irreversible.

While the service is active, you can access, correct, delete, or export your data through the product's own functions.

Governing documents

This page is a summary. The binding terms are:

• Data Protection Protocol
• Service Level Agreement
• Terms of Service
• User Agreement
• Privacy Policy
• Refund, Cancellation & Dispute Policy

Where this summary and a governing document differ, the governing document controls.

Contact

For security questions, compliance reviews, or to request documentation for a vendor assessment, email contact-us@flashcat.cloud or use the contact page. If you believe you have found a security vulnerability, please report it to the same address and we will route it to the engineering team.