Security & Trust

This page describes the security and privacy controls FlowOps has in place today. We only list measures that are implemented in the product. FlowOps does not currently hold third-party security certifications.

Where your data is hosted

The FlowOps database, sign-in service and file storage run in the European Union (AWS region eu-north-1, Stockholm, Sweden). Some supporting services, such as email delivery and optional analytics, are operated by other providers — see our list of subprocessors.

Workspace isolation

• Every workspace's records are separated at the database level using PostgreSQL Row Level Security. Row Level Security is enabled on every application table.
• Access rules are evaluated by the database for each request, based on the signed-in user's workspace — not on what the browser sends.
• Role-based permissions (Administrator, Management, Team Member) are enforced on the server and in the database, not only in the interface.

Encryption

• All connections to FlowOps use HTTPS (TLS).
• Stored data is encrypted at rest by our infrastructure provider as part of its managed database and storage service.
• Server credentials and API keys are kept on the server and are never sent to the browser.

Files

• Uploaded files are kept in private storage, separated by workspace.
• Files are opened through short-lived links (from one minute up to one hour) issued only to users who are allowed to see the file.

FlowOps staff access

• Internal operator access is separate from customer workspace roles and requires multi-factor authentication (authenticator app).
• Support access to a workspace is read-only, requires a stated reason and expires automatically (30 minutes by default, two hours at most).
• Operator actions are recorded in an append-only audit log.

Customer accounts can optionally turn on authenticator-app multi-factor authentication in Settings → Security. It is optional and not enforced for every customer; operator accounts always require it.

Payments

Paddle.com is our Merchant of Record and handles checkout, payments, invoicing and tax. FlowOps never receives or stores card numbers. Payment notifications from Paddle are verified with a cryptographic signature before they change any subscription.

Analytics and cookies

Product analytics (Google Analytics 4) stays off until you opt in. When enabled, record identifiers are removed from page addresses and no names, emails or workspace content are sent. Analytics never runs in the internal operator console. See our Cookie Policy.

Your data

• Administrators can export workspace records as JSON from Settings → Data & Privacy.
• Every user can download their own profile and activity data.
• Personal account or (for Administrators) whole-workspace deletion can be requested in the app. Requests are reviewed and carried out by our team. Cancelling a plan, a failed payment, an expired trial or a suspension never deletes data automatically. See our Privacy Notice.

Backups

Our managed database provider takes automated backups. FlowOps has not yet completed and documented its own restoration test, so we do not publish recovery-time or recovery-point commitments at this stage.

Reporting a security issue

If you believe you have found a vulnerability, email hello@flowops.it.com with "Security report" in the subject. Please do not access other customers' data while testing.