Skip to main content

Security report for flowcode.com

Flowcode · Technology · N/a

Medium risk. 4 critical or high findings in NIS2 compliance.

Security score

65/100

Risk levelMedium

Flowcode is a technology company specializing in enterprise QR code solutions that connect offline audiences to online brands. The company offers a comprehensive SaaS platform including QR code generation, landing pages, analytics, audience insights, and integrations tailored for enterprise clients. Positioned as a trusted partner for over 75% of Fortune 500 companies, Flowcode emphasizes data-driven marketing and customer engagement. The website demonstrates a mature digital infrastructure with modern analytics, marketing tools, and compliance mechanisms such as cookie consent and GDPR/CCPA certifications. Security posture is strong with HTTPS, bot protection, and SOC 2 compliance, though explicit security policies and incident response contacts are not evident. The absence of WHOIS data introduces some uncertainty about domain registration transparency, but the overall business credibility and website professionalism remain high.

Scanned

NIS2 and GDPR posture

NIS2 posture
22/ 100 · Critical
Checks completed
6of 7

Indicative only: based on publicly visible signals, not a certification or legal assessment. NIS2 signals relate to Article 21 of Directive (EU) 2022/2555; GDPR signals to Articles 7, 12, 13 and 32 of Regulation (EU) 2016/679 and Article 5(3) of the ePrivacy Directive. The other framework could not be assessed in this scan.

Priority findings

4 findings rated critical or high. Fix these first.

  1. NIS2 compliance

    NIS2 expects organisations in scope to show basic security hygiene. These public signals are what an auditor or customer sees first.

    • High

      No information security framework found

      NIS2 requires documented cybersecurity and information security measures

      What to do: Implement and document information security policies and procedures

      • NIS2 21(2)(a)
      • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
      • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
    • High

      No security policy documentation found

      NIS2 requires documented cybersecurity governance and risk management

      What to do: Create and publish cybersecurity policy and framework documentation

      • NIS2 21(2)(a)
      • IR 2024/2690 1.1: Implementing Regulation (EU) 2024/2690, Annex point 1.1: Policy on the security of network and information systems
      • NIST PL-1: NIST SP 800-53 Rev. 5 PL-1: Policy and Procedures
    • High

      No incident response procedures found

      NIS2 requires documented incident response and business continuity plans

      What to do: Implement and document incident response and business continuity procedures

      • NIS2 21(2)(b)
      • IR 2024/2690 3.1: Implementing Regulation (EU) 2024/2690, Annex point 3.1: Incident handling policy
      • NIST IR-8: NIST SP 800-53 Rev. 5 IR-8: Incident Response Plan
    • High

      No security contact information

      NIS2 requires clear incident reporting channels

      What to do: Add security contact information (e.g., security@domain.com)

Need hands-on remediation? Email guard@offseq.com

Keep watching flowcode.com

This scan found 22 issues across 6 checks. Monitoring re-runs those checks daily, emails you when something material changes and records each fix, so you can show progress.

Daily monitoring

Recommended

€25per month

  • TLS certificates and expiry
  • DNS records
  • SPF, DKIM and DMARC
  • Security headers
  • GDPR and NIS2 posture
  • Exposed services
  • Third-party trackers
  • Risk score drift

Email alerts on material changes and an exportable JSON history of every change.

Billed monthly. Cancel anytime. The full timeline opens with your unlock code.

Full report

€39.90one-time

  • The complete analysis as a PDF you can cite
  • Email delivery with an unlock code
  • Lifetime access to this report

Prices incl. 21% VAT. Payments by EveryPay; sold by SEQ SIA, Latvia.

Results by check

Each check with its score, findings and the evidence it collected.

Technical appendix

Business context, site observations and technical notes gathered during the scan, and the standards behind each reference.

Business context

Business profile

Flowcode operates in the technology sector, targeting enterprise brands and creators seeking to enhance offline-to-online customer engagement. Its business model revolves around subscription-based SaaS offerings with advanced analytics and customization capabilities. The company leverages partnerships and integrations to extend platform functionality. Growth indicators include a broad client base among Fortune 500 companies and a rich resource ecosystem including developer portals and support centers. The platform supports multiple industries and use cases, from marketing and sales to logistics and operations. Strategic observations highlight Flowcode's competitive advantage in combining QR code technology with data analytics and audience insights, positioning it well in the digital marketing landscape.

Security posture

Flowcode exhibits a mature security posture with enforced HTTPS, use of reCAPTCHA and Cloudflare Turnstile for bot mitigation, SOC 2 certification, and cookie consent management via OneTrust. The website does not expose sensitive data and employs multiple analytics and monitoring tools for performance and security insights. However, the lack of publicly accessible security policies, incident response contacts, and vulnerability disclosure mechanisms suggests room for improvement in transparency and readiness. No critical vulnerabilities or security misconfigurations were detected in the provided content. Compliance with GDPR and CCPA is indicated through certifications, but explicit privacy policy documentation was not found in the analyzed content.

Recommendations

  1. Publish a comprehensive privacy policy and terms of service prominently linked on the website.
  2. Add a dedicated security policy page including incident response procedures and contact information.
  3. Implement and publish a vulnerability disclosure policy or security.txt file to enhance transparency.
  4. Verify and publish WHOIS domain registration details to improve domain trustworthiness.
  5. Ensure all security headers (CSP, X-Frame-Options, Referrer-Policy) are explicitly configured and documented.
Site observations

Automated reading of the public site. Ratings are indicative.

Business

Company
Flowcode
Description
Flowcode® is an enterprise QR code platform that connects your offline fans to your online brand. Measure the ROI of your campaigns and capture first-party data essential for driving your business forward.
Key services
QR code generation, Landing pages, Analytics, Audience insights, Workspaces and team management, Integrations, API access
Content quality
excellent
Branding
consistent

Technology

Stack
Google reCAPTCHA, Heap Analytics, Datadog RUM and Logs, Optimizely, OneTrust Cookie Consent, Impact Affiliate Tracking, Webflow CMS, Cloudflare Turnstile Captcha
Platforms
Webflow
Performance
fast
Mobile
excellent
Accessibility
good
SEO
good

Security

Observed score
85/100
Good practices seen
  • HTTPS enforced
  • Use of reCAPTCHA and Cloudflare Turnstile for bot protection
  • Cookie consent with OneTrust
  • Use of SOC 2 compliance
  • No exposed sensitive data detected in HTML

Analytics and tracking

Services
Heap Analytics, Datadog RUM and Logs, Google Analytics, Optimizely
Tracking level
extensive
Privacy compliance
good

Advertising

Ad networks
Impact
Tracking pixels
Heap Analytics, Datadog RUM, Optimizely
Marketing tools
Optimizely, Heap Analytics, Datadog
Transparency
good

Site quality

Design
excellent
User experience
excellent
Content relevance
excellent
Navigation
excellent
Professionalism
excellent
Trustworthiness
high

Key observations

  1. Website is fully accessible with rich content and interactive features.
  2. Strong enterprise focus with multiple product offerings and resources.
  3. Good use of modern analytics and marketing technologies.
  4. Cookie consent and privacy compliance mechanisms are implemented.
  5. No explicit privacy policy or terms of service links found in provided content.
  6. Contact information includes a phone number and detailed contact form.
  7. Security best practices are evident but could be improved with explicit policies.
  8. WHOIS data is missing or unavailable, which is a concern for domain transparency.
Technical notes

Notes

The website is built on Webflow CMS and leverages a modern technology stack including Google reCAPTCHA, Heap Analytics, Datadog RUM and Logs, Optimizely for experimentation, and OneTrust for cookie consent management. Hosting appears to be via Webflow and Cloudflare, providing robust performance and security features. The site is well-optimized for mobile devices and accessibility, with fast loading times and clear navigation. The use of multiple analytics and marketing tools indicates a data-driven approach to user engagement and conversion optimization. Technical debt appears minimal, with opportunities to enhance security transparency and domain registration clarity.
Standards and sources

Reference chips under each finding point to the standard, regulation or specification the finding relates to. They are taken from the official datasets below and mapped conservatively: a finding with no defensible link shows none. NIS2 and GDPR references mark where a finding is relevant evidence, not a compliance verdict. Implementing Regulation (EU) 2024/2690 binds digital infrastructure and digital service providers; for other entities it is the most detailed public reading of the Article 21 measures.

Retrieved 2026-10-24

Reviews of this site

Share your experience with flowcode.com. Every review is verified by email and published after moderation.

Overall rating
Select a rating
4000 characters remaining

We’ll email you to confirm your review and keep your details private.

Community rating

Loading reviews…

Feedback on this report

Rate this report, add an optional comment, and tell us if you want a security specialist to follow up.

Overall report quality
Select a rating
2000 characters remaining

We only use your feedback to improve Guard reports. Contact details are never shared.