No, by design. Flow works only from the population and evidence you hand it. It does no extraction from client systems, which keeps less client data in play and keeps evidence reliability where your judgment can stand behind it, under AS 1105.10A.

No. Flow connects to your evidence collection, so a test can start the moment the materials land. You can also send a population by hand, or through the API from your own audit software, the way JOINSON&SPICE does.

Three things. It starts when your evidence arrives, rather than waiting for someone to open a session. It works only from the evidence you provide, so it never reaches into your client’s systems. And what comes back is documented to a named standard, ISA 230, citable by paragraph.

Yes. Flow comes with a standardized library that works well by default, and your firm owns it and can adjust it centrally, so every engagement runs the same reviewed way.

Flow is ISO 27001:2022 certified, hosts your data in the EU, and never uses your data to train AI models. Because Flow never pulls from client systems, there is less client data in play to begin with. Further security documentation is available on request.