Discover Digital

Flowella: WhatsApp for Business Platform Integration and Automation

Flowella is a no-code SaaS platform that converts existing forms into interactive WhatsApp Flows. Submissions sync directly to CRM/form tools as if completed on a web form. Includes HubSpot workflow integration, WhatsApp message templates, conversation inbox, opt-in/out management, and Meta Business API connectivity.

Features

• Convert existing CRM/ Web forms to WhatsApp Flows
• No-code form-to-WhatsApp configuration
• Real-time field validation within WhatsApp chat
• Structured data sync back to source CRM/form tool
• HubSpot workflow action for automated WhatsApp messaging
• Meta-approved WhatsApp message template management
• Opt-in/opt-out compliance management
• WhatsApp Business API integration via Meta
• Multi-step guided chat flows with buttons, dropdowns, file uploads
• End-to-end encryption for data exchange

Benefits

• 98% message open rates vs 20% email average
• Higher form completion rates via conversational interface
• Meet customers on their preferred channel (3B+ WhatsApp users)
• Eliminate manual data entry with automated CRM sync
• Reduce landing page friction and form abandonment
• GDPR-compliant consent tracking built-in
• No custom backend development required
• Faster lead capture and response times
• Unified inbox for WhatsApp alongside email and chat
• Consistent brand experience across messaging channels

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@discoverdigital.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

987503193563745

Contact

G-Cloud Enquiries Team
0118 974 4736
info@discoverdigital.com

About your service

• Service categories:

  Applications

  Customer relationship management

  • Marketing campaign management
  • Customer service

  Advertising

  • Advertising Placement
  • Advertising Measurement
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Flowella requires a Meta Business Account and WhatsApp Business API access. Meta charges WhatsApp conversation fees separately (not included in Flowella subscription). Message templates require Meta approval before use. Service requires buyer to have compatible form/CRM tool (HubSpot, Google Forms, SurveyMonkey). WhatsApp policies and rate limits apply. Support is remote, with hours and SLAs agreed at call-off.
• System requirements:
  • Meta Business Account with WhatsApp Business API access
  • Compatible form/CRM tool (HubSpot, Google Forms, Typeform, or SurveyMonkey)
  • Valid payment method registered with Meta for WhatsApp conversation fees
  • Supported browser: Chrome, Edge, Firefox, Safari
  • Internet connection for web-based administration
  • Phone number for WhatsApp Business registration (mobile or landline)

User support

• Email or online ticketing support: Yes
• Support response times: We acknowledge support requests within 1 business day (Mon–Fri, UK business hours). Priority is agreed at triage, and we’ll provide an estimated resolution time once the issue is understood. For urgent incidents, we aim to respond within 4 business hours. Weekend and out-of-hours support can be agreed in advance where required.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Flowella platform support is provided via the Flowella Knowledge Base and email. Buyers are assigned an Account Manager for onboarding and service coordination. Standard support covers platform access, configuration guidance, and incident triage during UK business hours (Mon-Fri 9am-5pm). Enhanced support packages with dedicated consultancy, custom integration development, and tighter SLAs are available at additional cost. Implementation projects (custom flows, CRM integration, training) are scoped and priced separately at published consultancy rates.; Standard support is included within the agreed subscription and support package and covers incident triage, guidance, minor configuration, and best-practice advice.; ; Enhanced support is available where buyers require additional capacity, proactive governance, or tighter response commitments. Enhanced support is priced as an agreed retainer and/or at our published day rates.; ; Implementation projects (configuration, integrations, migration, training, and optimisation) are scoped and costed separately, and may include a dedicated Project Manager where required, following the common partner delivery model used on Digital Marketplace
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Flowella offers self-service onboarding with guided setup via the Flowella Knowledge Base. Onboarding includes: connecting Meta Business Account, installing HubSpot integration (if applicable), selecting Quick Start templates, and configuring message templates. A 14-day free trial is available. For complex deployments, Discover Digital provides consultancy services including requirements discovery, custom flow design, integration development, and user training (virtual or onsite at additional cost).
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: At contract end, buyers retain full access to data within their connected systems (HubSpot, Google Forms, etc.) as Flowella syncs submissions directly to those tools. Conversation logs and analytics can be exported from the Flowella dashboard. WhatsApp message history remains in the buyer's WhatsApp Business Account. Flowella does not independently store customer data beyond what is necessary for message delivery and sync. Upon termination, Flowella access is revoked and any session data held by Flowella is deleted.
• End-of-contract process: At contract end, Flowella access is disabled. All data submitted via WhatsApp Flows has already been synced to the buyer's connected systems (CRM/form tools) and remains accessible there. The buyer retains ownership of their Meta Business Account, WhatsApp Business number, and approved message templates. Standard offboarding includes: confirming data sync completion, guidance on Meta account continuity, and revoking Flowella platform access. Additional consultancy for transition or migration is available at published rates.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile access is supported, but some functionality is reduced compared with desktop. The mobile experience is focused on day-to-day tasks and optimised for smaller screens. Administration, configuration and complex reporting are typically easier on desktop.
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: Users access Flowella via its web-based dashboard (browser) to configure WhatsApp Flows, manage message templates, and view analytics. End-users interact with WhatsApp Flows through the WhatsApp mobile or desktop app. Flowella integrates with HubSpot to provide a custom inbox channel for WhatsApp conversations. Administrators configure flows, templates, and integrations through the Flowella web interface. Role-based access controls are managed through the connected HubSpot portal.
• Accessibility standards: EN 301 549
• Accessibility testing: Discover Digital has not carried out formal usability testing of the HubSpot user interface with assistive technology users, as the interface is provided by HubSpot. We support buyers with onboarding and managed administration, and we provide alternative support channels (email, phone, and agreed collaboration channels) to ensure users can access help if accessibility needs arise. Where required, we will work with the buyer to agree reasonable adjustments and accessible ways of working.
• API: Yes
• What users can and can't do using the API: Flowella integrates via the WhatsApp Business API (Meta) and provides webhook support for custom integrations. Users can configure form-to-flow mappings, manage message templates, and receive structured submission data via webhooks. The platform connects to HubSpot, Google Forms, Typeform, and SurveyMonkey via OAuth/API. Webhook endpoints allow integration with additional systems. Limitations: Direct API access to Flowella internals is not provided; integrations are managed through the admin interface and supported connectors.Users can make changes through the API including creating and updating CRM records, managing workflows and automation, configuring properties and pipelines, and managing user permissions. Bi-directional integrations with other business systems can be built using the API.; The API also supports webhook subscriptions for real-time event notifications, analytics data retrieval, and content management for websites hosted on HubSpot.; Limitations: Some administrative functions require portal access rather than API calls. API rate limits apply based on subscription tier. Certain features may require specific HubSpot subscription levels to access via API.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Flowella allows customisation of WhatsApp Flows including question structure, field mappings, validation rules, conditional logic, and branding. Message templates can be customised with personalisation tokens. Workflow triggers and automation rules can be configured within HubSpot. Consultancy services are available to support custom flow design, complex integrations, and bespoke implementation requirements. Platform customisation is performed through the Flowella admin interface by users with appropriate permissions.

Scaling

• Independence of resources: Flowella operates a multi-tenant SaaS architecture with logical isolation between customer environments. Each buyer's WhatsApp Business Account, message templates, and flow configurations are segregated. Platform infrastructure uses auto-scaling to maintain performance under varying loads. Rate limiting is applied in accordance with Meta's WhatsApp Business API policies to ensure fair usage and protect service stability for all users. One buyer's activity does not impact another buyer's performance or data.

Analytics

• Service usage metrics: Yes
• Metrics types: Flowella provides service usage metrics including: conversation volumes, message delivery and read rates, WhatsApp Flow completion rates, form submission counts, template approval status, and opt-in/opt-out tracking. Data is viewable in real-time via the Flowella dashboard. HubSpot users can access conversation data through HubSpot reporting. Analytics can be exported for external analysis. Regular usage reports are available on request.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Flowella encrypts data at rest using AES-256 encryption. Data in transit is protected using TLS 1.2 or above. WhatsApp messages are end-to-end encrypted by Meta's infrastructure. Customer submission data is transmitted directly to the buyer's connected CRM/form system and is not persistently stored by Flowella beyond operational requirements (message delivery confirmation, sync status). Access to infrastructure and encryption keys is strictly controlled and limited to authorised personnel.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users can export data at any time through multiple routes. Submission data syncs in real-time to the buyer's connected systems (HubSpot, Google Forms, Typeform, SurveyMonkey) and can be exported using those tools' native export features. Conversation logs and analytics can be exported from the Flowella dashboard in CSV format. WhatsApp message history is retained in the buyer's Meta Business Account. Flowella does not hold primary data copies; the connected CRM/form tool serves as the system of record.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Flowella platform availability target is 99.9% during standard operating hours. The service depends on Meta's WhatsApp Business API, which has its own availability commitments. Discover Digital provides consultancy and support services during UK business hours, Monday to Friday, 9am-5pm. Extended support is available at additional cost by prior arrangement. Platform status and any service disruptions are communicated via the Flowella dashboard and email notifications. Refunds for service level failures within Discover Digital's control are discussed on a case-by-case basis.
• Approach to resilience: Flowella is hosted on cloud infrastructure (AWS/Azure) with built-in redundancy and automated failover capabilities. Key resilience features include: geographically distributed hosting, automated backups, load balancing, and real-time monitoring with alerting. The platform is designed for high availability with no single point of failure for core services. WhatsApp message delivery benefits from Meta's enterprise-grade infrastructure resilience. Disaster recovery procedures are documented and tested regularly.
• Outage reporting: Flowella provides outage reporting through multiple channels. Platform status and incident notifications are displayed in the Flowella dashboard. Registered administrators receive email alerts for service disruptions or planned maintenance. For WhatsApp-specific issues, Meta's status page (developers.facebook.com/status) provides real-time WhatsApp Business API status. Discover Digital notifies affected buyers directly via email for any scheduled maintenance or significant incidents. Post-incident reports detailing cause, impact, and resolution are provided on request for significant outages.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to Flowella management interfaces is controlled through role-based access controls. Access follows the principle of least privilege, with permissions granted only for specific roles and responsibilities. Customer portal access is authenticated via secure login with MFA available. Support channels require identity verification before any account changes or sensitive information is disclosed. Access permissions are reviewed quarterly and revoked promptly when no longer required (e.g., staff departure, role change). Privileged access to production systems is logged and auditable. Third-party access (e.g., for support or integration) requires explicit authorisation and is time-limited.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials
• Information security policies and processes: Discover Digital Solutions maintains a comprehensive suite of information security policies covering data protection, access control, acceptable use, incident response, and secure development. Security governance is overseen by a named director with board-level responsibility for information security, reporting directly to the Managing Director. Policy compliance is enforced through staff training during onboarding and annual refresher sessions. All team members acknowledge and adhere to security policies as a condition of employment. We maintain Cyber Essentials certification, demonstrating commitment to protecting against common cyber threats. Policies are reviewed regularly to ensure alignment with evolving security requirements, industry best practices, and regulatory obligations including UK GDPR.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Flowella platform changes follow a defined change management process. All code changes are version-controlled using Git with mandatory code review before deployment. Changes are tested in staging environments before production release. Infrastructure configuration is managed using Infrastructure as Code (IaC) principles via Azure Resource Manager templates. Change requests are documented, assessed for security impact, and require appropriate sign-off before implementation. Production deployments follow a controlled release process with rollback capabilities. Configuration changes affecting customer data or security require explicit approval from the technical lead. An audit trail of all platform changes is maintained.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Flowella uses a multi-layered approach to vulnerability management. Azure provides continuous security assessment and threat detection through Microsoft Defender for Cloud. Application dependencies are monitored for known vulnerabilities using automated scanning tools (e.g., Dependabot, Snyk). We subscribe to security advisories from Microsoft Azure, Meta (WhatsApp Business API), and relevant software vendors. Critical vulnerabilities are prioritised for remediation within 14 days of disclosure; high-severity issues within 30 days. Regular penetration testing is conducted at least annually by external security specialists. Our Cyber Essentials certification validates baseline vulnerability management controls across endpoints and infrastructure.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Flowella implements protective monitoring using Azure's native security services. Azure Monitor and Log Analytics collect and analyse platform logs, access events, and security telemetry.Application-level logging captures authentication events, API access, and administrative actions. Alerts are configured for suspicious activity patterns including unusual login attempts, privilege escalation, and data access anomalies. Upon identifying a potential compromise, affected systems are immediately isolated, scope is assessed, and incident response procedures are initiated. Critical security incidents are escalated within one hour to senior management and reported to affected customers where required. Logs are retained for a minimum of 90 days.
• Incident management type: Supplier-defined controls
• Incident management approach: Discover Digital maintains pre-defined incident response processes for common events including security incidents, data breaches, service outages, and platform errors. Users report incidents via email to our operations team or through the support channels defined in their contract. Incidents are logged, categorised by severity, and escalated according to defined procedures. For security incidents, we follow a structured response: identification, containment, eradication, recovery, and lessons learned. Incident reports are provided to affected customers detailing the issue, impact, timeline, resolution, and preventive measures. Post-incident reviews are conducted for significant events to identify improvements to processes and controls
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 14-day free trial of Flowella with full feature access including WhatsApp Flow creation, HubSpot integration, message template management, and conversation inbox. Free initial consultation available for requirements scoping, platform demonstration, and solution architecture advice. Trial does not include Meta's WhatsApp conversation fees (charged separately by Meta) or implementation consultancy services.
• Link to free trial: https://flowella.io/pricing

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 7%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 12%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@discoverdigital.com. Tell them what format you need. It will help if you say what assistive technology you use.