MapFlow

Citizen data is staged in a UK-sovereign cloud Postgres database. Every PII field is AES-256-GCM encrypted on the operator's Local Proxy before it reaches the database, so the database itself only ever holds ciphertext. The encryption key is TPM-bound (TPM 2.0) to the proxy host via Windows Credential Guard and never reaches the US-parent Base44 platform. A raw Master Recovery Key is escrowed to the council's own corporate vault as the break-glass DR path.

Per-environment key lifecycle: a real PII key only exists during an active transfer/UAT window — Test1, Test2, and Live each use a dedicated key destroyed after its stated use. No long-lived key to compromise. Blind-index search: HMAC-SHA256 search columns enable exact-match lookups on encrypted audit data without exposing plaintext to the database. Sovereign custody: the Council retains the Master (archive) recovery key in its own corporate vault — the Council can restore its own backups without depending on VGT or the Base44 platform. The sovereign database is never accessed via the postgres superuser — a least-privilege role is provisioned server-side and the superuser password is burned post-setup so no human holds it.

MapFlow's security is continuously verified across three tiers: Roboshadow (proactive endpoint and application vulnerability monitoring — CVE scanning, patch tracking, remediation workflow), Base44 (platform infrastructure, SOC 2 Type II / ISO 27001), and VGT/MapFlow (app-layer code). On 2026-08-27, an internal security audit identified three MFA findings — plaintext TOTP secrets, base64-encoded backup codes, and no rate limiting — all of which have been fixed: secrets are now AES-256-GCM encrypted at rest, backup codes are SHA-256 salted-hashed, and 5-attempt lockout with 15-minute cooldown is enforced. The full audit reference — including the three-tier ownership model, all findings with fixes, and OWASP ZAP scan results — is published on the Independent Security Audit page. A detailed Salesforce vs MapFlow InfoSec comparison is also available.

End-to-end UK data residency with zero CLOUD Act exposure on citizen data. The staging database and the AI inference layer are both UK-sovereign — UK-registered, UK-owned, with no US operations — bound only by UK domestic law. The only US-parent platform (Base44) is the UI/orchestration layer; it never persists client data — ciphertext transits volatile memory (RAM) only and a US production order returns app metadata only, so there is nothing for it to disclose. AI inference routes exclusively to RelaxAI (UK data centres, ISO 27001, Cyber Essentials, SOC 2) via the Sovereign Inference Shuttle; prompts and LLM keys stay on the Local Proxy and never transit Base44. The default field-mapping engine is non-AI (algorithmic, zero data shared). The AI engine is admin-gated (off by default) with mandatory InfoSec warnings when enabled.

GeoIP enforcement: admin-configurable policies for non-UK IPs, VPN/datacenter detection, timezone mismatch, and FireHOL blocklists — with a Council IP allow-list option for office CIDR ranges. Deep PII access grants: viewing decrypted citizen data requires an explicit, audited per-user permission grant with mandatory reason — self-grants email all other admins automatically. Weekly posture monitoring: automated InfoSec checks run every Monday and on-demand, emailing all admins on Critical/High violations and recording every finding in an auditable log.