What Webflow covers, and on which plan
This is what Webflow's own pages say as of November 2026. Send it to your security team before anyone writes a questionnaire.
| Control | What Webflow says | Plan | Source |
|---|---|---|---|
| Compliance reports | SOC 1 Type 2, SOC 2 Type 2, ISO/IEC 27001, 27017, 27018 and 42001 | All | Trust Center |
| Encryption | TLS 1.2+ for all sites, data encrypted at rest, HSTS on by default | All (HSTS settings configurable on Enterprise) | Security page |
| Traffic protection | Global CDN with DDoS protection and built-in rate limiting | All | Security page |
| Sign-in | Two-factor authentication | All | Security page |
| Single sign-on | SAML and OAuth, optional or required, one identity provider per Workspace | Enterprise | SSO guide |
| User provisioning | SCIM adds and removes access from your identity provider; JIT creates accounts at first SSO sign-in | Enterprise | SCIM guide |
| Custom roles and approvals | Up to 20 custom roles; required approvers sign off before a branch merges | Enterprise | Roles guide |
| Publishing workflows and Site Activity log | Publishes, CMS changes, backups and custom code edits, up to 1 year of history | Team and Enterprise, per the pricing page | Pricing |
| Audit log API | User access, role, membership and invitation events, kept 1 year | Enterprise | Audit log guide |
| Certificates and headers | Custom SSL certificates; custom security headers such as CSP and X-Frame-Options | Enterprise | Security page |
| Hosting uptime SLA | 99.99% on Enterprise, 99.00% on Team; site plans list a "standard agreement" | Enterprise, Team | Pricing |
The Enterprise rows are where projects get stuck. If IT needs single sign-on, automatic provisioning or sign-off before anything goes live, you're buying Enterprise. Settle that before you brief a designer.
SSO and provisioning: where reviews stall
We've seen an enterprise Webflow redesign stall because the client's IT required single sign-on for everyone editing the site. SSO is only on Enterprise Workspace plans, so that one requirement sets your plan.
These are the questions to answer before design starts:
- Which identity provider? Webflow supports SAML and OAuth connections, but its SSO guide names no providers. It asks you to confirm yours through the Enterprise portal. Get that answer in writing before you sign.
- Does access end when someone leaves? Yes, with SCIM. It creates accounts from your provider's assignments, removes Workspace access when they end and syncs name and email changes. It doesn't assign roles or groups, so roles are still set in Webflow.
- Do new hires need an invite? Not with JIT provisioning, which creates the account at their first SSO sign-in. JIT only works with SSO enforced.
- How does the agency get in? People whose email domain isn't on your provider can use optional SSO or join as guests. Guest access doesn't require SSO, even when it's enforced.
Agree the plan, the identity provider and agency access in one meeting with IT. We work through named user accounts with the roles you assign, no shared logins, removable at any time.
Roles, approvals and the audit trail
Next comes control: who can publish, and proof of who changed what. Everything below is Enterprise-only except the Site Activity log, which the pricing page also lists on Team.
- Custom roles. Workspace admins can create up to 20. Publishing the whole site or one page, to staging or production, editing without approval, approving, merging and publishing CMS items are each switched on separately. The base roles are Reviewer, Content editor, Marketer and Designer.
- Design approvals. Editors whose role needs approval work in page branches, and every required approver must approve before a branch merges into the main site.
- Limited access. On some Enterprise plans, you can restrict a member to certain CMS collections, secondary locales or pages.
- Audit log API. Access, role, membership and invitation events are kept for 1 year and can be pulled into SIEM tools such as Splunk, Datadog or SumoLogic. History starts in May 2025.
- Site Activity log. Publishes, CMS changes, backups and custom code edits, with up to 1 year of history.
Write down who drafts, who approves and who publishes to production before the build starts. Then the roles exist on launch day instead of being added later.
Hosting, uptime and what you still own
Webflow says Enterprise is hosted on AWS and delivered through Cloudflare's global CDN, with DDoS mitigation from both. For incident history, point IT to Webflow's status page.
Support targets on Webflow's pricing page are 1 hour for major issues and 4 hours for minor ones on Enterprise, and 12 and 24 hours on Team.
For recovery, Webflow makes a restore point on every 50th autosave. Paid site plans get unlimited backups, and only Site managers can restore them.
There are no plugins or servers for your team to patch, so the PHP and plugin patching a WordPress site needs goes away.
Some risks stay with you. Review custom code and embeds, third-party scripts and tags, and what your forms collect. If your policy says where data must be stored, ask Webflow's Enterprise team and check the subprocessor list before you sign.
How to get through the vendor questionnaire
Work in this order, so IT reviews Webflow's evidence instead of writing questions from scratch.
- Request Trust Center access. The Trust Center lists SOC 1 and SOC 2 Type 2 reports, ISO certificates, an annual pentest report, a BCP/DRP test letter and the Shared Security Responsibility Model. Sensitive files sit behind "Get access".
- Send the standard questionnaires first. Webflow's CAIQ and SIG Lite self-assessments are there too. Send them before IT drafts its own. The Enterprise page also offers a Whistic profile.
- Review the DPA. Webflow's DPA forms part of its agreement, has a pre-signed copy, and includes EU Standard Contractual Clauses and a UK addendum. It promises notice of a confirmed breach "without undue delay".
- Sign up for subprocessor notices. You get 15 calendar days to object to a new subprocessor. If you don't sign up, the DPA treats you as having waived that right.
- Raise gaps on day one. The SSO plan, your identity provider, data location and any regulated data belong in the first call with Webflow, not the last.
- Paper the agency too. On our Webflow builds, we sign your MSA or provide ours, sign mutual NDAs, add a DPA if we handle personal data and complete your vendor security questionnaire.
Send us your security questionnaire, your identity provider and the list of people who will edit the site. We'll map them to the right Webflow plan before design starts. See how we run Webflow for enterprise teams, or send them over.
