Infrastructure and tenancy
Flowformance runs on Cloudflare’s global platform. Every workspace’s data is isolated by tenant at the data layer, and cross-tenant isolation is covered by automated tests that run on every change.
Encryption and access
- All traffic is encrypted in transit with TLS; stored data is encrypted at rest by our infrastructure providers.
- Sign-in is passwordless (one-time email links), so there are no passwords for us to store or leak.
- Access to workspace content is governed by roles and visibility settings. Private images are checked on every request, and image links issued to AI agents expire within 2 hours; newly uploaded private videos play only through short-lived signed tokens.
Payment security
Payments are processed by Stripe, a PCI-DSS Level 1 provider. We never see or store full card numbers.
AI and data handling
We use AI providers to transcribe and draft content; we do not permit them to train their models on your content, to the extent they offer that control. See our Privacy Policy for details, and our subprocessors for who processes data on our behalf.
Backups and continuity
We take routine operational backups for our own resilience and keep each for 30 days. These are not a substitute for your own backups — your workspace admins can export your content at any time, and you should keep current copies of anything important, as described in our Terms of Service.
Reporting a vulnerability
If you believe you’ve found a security vulnerability, please report it through our contact form with enough detail to reproduce it. We investigate all good-faith reports. We ask that you avoid privacy violations, data destruction and service disruption, and give us reasonable time to address the issue before any public disclosure; in return, we will not pursue or support legal action against good-faith research that follows these guidelines. Our machine-readable contact is published at /.well-known/security.txt.
Contact
General security questions? Use our contact form.