--- title: "Procurement & vendor assessment" description: "For buyers and security reviewers: the Flowie e-invoicing integration plan, security (ISO 27001), GDPR and sub-processors, SLA and support, continuity, environment and exit, in one page." canonical: "https://docs.get-flowie.com/guides/procurement" source: "https://docs.get-flowie.com/guides/procurement.html" --- # Procurement & vendor assessment Guides # Procurement & vendor assessment This page is for buyers, procurement teams and security reviewers assessing Flowie for e-invoicing. It covers what the integration takes and who does what, followed by the facts on security, privacy, quality, continuity, environment and exit. Each answer links to the page that proves it. Your contract and Data Processing Agreement prevail over this page. ## At a glance Question| Answer ---|--- Who operates the service?| Flowie SAS, Paris, France, part of the Sovos group. Flowie is a registered French Plateforme Agréée (PA) and a Peppol Access Point. Sovos carries the transmission to networks and tax platforms outside France. What does it do?| Builds, sends, receives, validates and tracks compliant e-invoices in 150 countries through Sovos: Peppol, the French PA/PPF network, and clearance and reporting regimes. 47 countries have detailed guides in [Compliance](<../compliance/index.html>). How long does integration take?| A first invoice reaches the sandbox in minutes. A standard API integration usually takes days to a few weeks, depending on your systems. See the [integration plan](<#integration-plan>). Certification| ISO/IEC 27001, under the Sovos group certification. Where is the data?| Google Cloud, Paris region (`europe-west9`) for every production database and service. Does AI see our invoices?| Not through the Exchange API: it sends no document content to any AI model. See [AI](<#ai>). Availability| 99.9% monthly target. See [Quality & support](<#quality>). Can we leave?| Yes. You get a full export within 30 days of the end of the contract, in open formats (UBL, CII, JSON). See [Exit & portability](<#exit>). ## Integration plan Every step is documented and testable in the [sandbox](<../sandbox/index.html>) before anything touches a real network. Step| What happens| Who| Typical effort ---|---|---|--- 1 · Try| One call creates a sandbox key with a seeded company, with no sign-up and no sales call.| Your developer (or an AI agent)| Minutes 2 · Connect| Pick your path: REST API, MCP for an AI assistant, or a connector for your ERP. See [Integrations]().| Your developer, or Flowie for enterprise connectors| Hours to days 3 · Send & receive| Send invoices with `POST /v1/documents/send` and receive them through webhooks or polling. See [Send an invoice]() and [Receive invoices]().| Your developer| Days 4 · Test| Recipient simulators, lifecycle and error scenarios, and time travel, all in the sandbox. See [Test extensively](<../sandbox/index.html#test-recipients>).| Your developer and QA| Days 5 · Register| Your companies are registered on Peppol and on the French PA network, or moved from your current platform. See [Portability]().| Flowie, with your company identifiers| Days, depending on the country 6 · Go live| Production key, then the go-live checklist. See [Go-live checklist]().| You and Flowie| One session **What you provide:** the legal identifiers of each entity (VAT, SIREN/SIRET or national ID), a technical contact, a webhook endpoint or polling job, and, for an ERP connector, access to its API or its file exports. **What Flowie provides:** sandbox and production keys, the network registrations, the connectors, and support through go-live. ## Flowie in your AI assistant Besides the Exchange API, Flowie offers an MCP server for the Flowie app, so your teams can use Flowie in plain language from the AI assistant they already work in. * **Order-to-cash:** create and send compliant invoices and credit notes, and follow what customers owe. * **Procure-to-pay:** purchase requests and orders, approvals, supplier invoices and payments. * **Spend control:** budgets, supplier spend, reports and dashboards. * **Suppliers:** supplier records, onboarding forms and the Flowie network. * **Automation:** tasks, workflows and schedules. **Building blocks for any process:** * **Lego blocks:** triggers, checks, approvals, tasks, documents, notifications and connectors snap together to model any internal process, from a purchase request to a supplier onboarding, by configuration rather than a development project. * **Templates to start fast and stay compliant:** ready-made setups carry the e-invoicing rules of the main mandate countries (France, Germany, Belgium, Italy, the Netherlands, Norway, Poland and Slovakia), so a team starts from something that already works and complies. * **Connected to your tools:** ERPs, document capture, banking, messaging and any system with an API plug into the same processes, and many more integrations are available than any list shows. See [Integrations](). * **Approval processes:** multi-level approvals by amount, entity, budget or any field, with delegation and reminders. * **Fine-grained permissions:** rights per organization, entity, role and object decide who sees and does what, and an assistant inherits exactly the user's rights. * **Full audit:** every action, by a person or an assistant, is recorded with who, what and when, on every document and every step. * **Fast:** a standard setup is deployed in hours, and a saved setup rolls out to other entities and environments without starting again. * **Highly secured:** ISO 27001, encryption in transit and at rest, scoped credentials and organization isolation. See [Security](<#security>). **Orchestration:** one request in plain language can drive a whole process, not just one screen. * **Multi-step work:** the assistant chains the steps itself, for example finding the customer, creating the invoice, checking it, sending it and following its status, and reports back at each step. * **Your rules still apply:** approvals, controls and routing run in Flowie's own workflows, on the server. An assistant cannot skip an approval or act outside the user's rights. * **People and agents together:** work that needs a person becomes a task or an approval for the right owner, and the process resumes once it is done. * **Runs without a prompt:** workflows react to events (an invoice received, a status changed) and schedules run recurring work, with or without an assistant. * **Reusable agents:** teams can set up agents and skills in Flowie for their own recurring tasks, governed like any other workflow. * **Built to scale:** high-volume sending and system integration go through the Exchange API, so the assistant handles the decisions and the platform handles the volume. **Any assistant, any cloud:** the server speaks MCP, an open standard, with a standard OAuth sign-in. It works with assistants on every major AI platform and cloud: Claude, ChatGPT, Amazon Quick on AWS, Cursor and VS Code, and any other MCP client. You are not tied to one AI vendor or cloud, and you can change assistant without changing the integration. **Multicloud, following country requirements:** the Flowie platform runs in Google Cloud Paris. Where a country requires e-invoices to be processed or stored in a given place or through a given platform, the documents for that country follow that requirement through Sovos and the national platforms, whichever assistant started the action. **Governance:** the assistant acts as the signed-in user, with exactly that user's permissions, never a shared key, and every call is logged. Which assistants you allow, if any, is your decision. See [Build with AI](<../build-with-ai/index.html>). ## Security * **Certification:** ISO/IEC 27001, under the Sovos group certification. The certificate and its scope (Statement of Applicability) are available on request. * **Encryption:** TLS 1.2 or higher in transit, and Google Cloud encryption at rest (AES-256). * **Authentication:** OAuth 2.1 / OpenID Connect sign-in, or scoped API keys you can rotate and revoke. An AI agent gets its own single-use, expiring [handoff](<../reference/index.html#oauth-handoff>) credential, never your key. See [API keys](<../sandbox/keys.html>). * **Isolation:** every token is bound to one organization, which scopes every read and write. * **Traceability:** a full audit trail on every document and lifecycle transition, plus a [request inspector](<../requests.html>) for every API call. * **Webhooks:** HMAC-signed and retried. See [Webhooks](<../reference/webhooks.html>). * **Vulnerabilities:** critical vulnerabilities are remediated within 15 days. ## Privacy & GDPR * **Roles:** for documents processed on your behalf, you are the controller and Flowie is the processor, under a Data Processing Agreement (available on request). * **Location:** Google Cloud, Paris region (`europe-west9`). Documents sent to a national platform (PPF, SDI, and others) are also processed by that platform under its own legal regime. * **Data minimisation:** the API processes what an e-invoice legally contains (parties, identifiers, lines, amounts) and the lifecycle events attached to it. Nothing else is required. * **Retention:** follows statutory invoice archiving, commonly six to ten years depending on the country. Sandbox data is synthetic and purged on a rolling basis. * **Rights:** data subjects exercise their rights through the controller. Write to [privacy@flowie.fr](). Full details on the [Privacy](<../privacy.html>) page. ### Sub-processors used by the Exchange API Provider| Purpose| Location ---|---|--- Google Cloud| Hosting, databases, storage| Paris, France (`europe-west9`) Okta (Auth0)| User sign-in| EU tenant Sovos (Flowie's group)| Transmission to e-invoicing networks and tax platforms| Per destination country The full list for your contract, covering every Flowie product you use, comes with the DPA. ### AI The Exchange API does not send document content to any AI model. AI features in the Flowie app (invoice capture, the assistant) use AI model providers listed in the DPA. They are optional and can be left out of your scope. ## Quality & support * **Availability:** 99.9% monthly target. Planned maintenance never runs on weekdays between 10:00 and 18:00 Paris time. The full SLA is at [get-flowie.com/sla](), and your contract's SLA prevails. * **Support:** Monday to Friday, 9:00 to 18:00 Paris time. First response within 2 hours for P1, 4 hours for P2, and the next business day for P3, at [support@flowie.fr](). * **Stable contract:** the API is versioned in its path (`/v1`). A breaking change only ships in a new version, with a deprecation window. See the [versioning and deprecation policy](). Every change is listed in the [changelog](<../changelog.html>). * **Correctness:** documents are checked against the official rules (Peppol BIS, French schematrons, and others), and `POST /v1/documents/validate` runs the same checks without sending. `Idempotency-Key` makes retries safe. Documentation and code are checked against each other on every release. * **Transparency:** the contract is public as [OpenAPI 3.1](<../openapi.json>), and [every error code](<../reference/errors.html>) is documented with its fix. ## Continuity * **Backups:** daily, with 7-day point-in-time recovery on production databases. The document store is highly available across zones in the Paris region. * **Targets:** recovery point objective 1 hour, recovery time objective 8 hours, within the Paris region. * **No silent loss:** reports to tax platforms are retried with backoff, and a delivery that fails comes back to you as a `document.failed` event with its error code, never silently. ## Environment * **Hosting:** Google Cloud's Paris region, on France's low-carbon electricity grid. Google publishes the carbon data for each region at [cloud.google.com/sustainability/region-carbon](). * **Efficient by design:** services are stateless and autoscaled, so compute follows actual load, and one shared platform serves every customer. * **Less paper:** e-invoicing replaces printed and posted invoices and manual re-keying. ## Exit & portability * Full export of your data within 30 days of the end of the contract, deleted 60 days after the end of the contract. * Open formats throughout: UBL 2.1, CII, Factur-X and JSON. Nothing proprietary to convert. * Changing platform is a regulated, documented process. See [Portability](<../portability/index.html>) for France and the rest of Europe. ## Documents on request The ISO 27001 certificate, the Data Processing Agreement, the sub-processor list for your scope, and answers to your security questionnaire are available on request. Write to [platform@flowie.fr]().