Security

What we do

• HTTPS for the website, dashboard and API.
• Database and file storage encrypted at rest by our database provider, Supabase.
• Webhook signing secrets, provider credentials, OAuth tokens and stored idempotent responses encrypted by Flowyn with AES-256-GCM.
• API keys stored only as SHA-256 hashes. A key is shown once; we cannot recover it.
• Separate test and live environments with separate keys.
• Workspace and environment access derived from the credential on every request.
• Outbound jobs, webhooks and monitors blocked from private and internal network addresses.
• Keys, secrets and tokens redacted from logs and error reports.
• Signed webhook deliveries so your endpoints can verify them.
• Optional browser error diagnostics only with consent, with no session replay or performance tracing.

What we do not do yet

• We hold no SOC 2, ISO 27001, HIPAA or PCI DSS certification of our own. Our providers' certifications cover their infrastructure, not Flowyn's application.
• Job headers and bodies, event payloads, endpoint URLs and alert targets are stored as sent, not encrypted by Flowyn beyond the provider's encryption at rest. Use short-lived or scoped credentials in job headers.
• We have not commissioned an independent penetration test.
• There is no SLA during the Beta.

Reporting a vulnerability

Email support@flowyn.dev with "Security" in the subject. Pending owner decision: set up a dedicated security@flowyn.dev address and publish /.well-known/security.txt Include what you found, how to reproduce it and its impact. Please give us reasonable time to fix it before publishing, do not access or change other customers' data, do not degrade the service, and do not use social engineering. Pending legal review: decide on a safe-harbour statement for good-faith research