Security & trust
Your data, your keys. Plainly explained.
How we protect your workspace, what we share and with whom, and what we don't have yet. No fine print.
How we protect you
Security built into the product.
Encrypted credentials and AI keys
Integration tokens, vault secrets and AI provider keys are encrypted at rest with a key kept outside the database. The full secret is never sent back to a browser.
Workspace isolation
Every workspace's data is separated in the database with row-level security. Data from one workspace is never visible in another.
Your own AI account
We don't resell AI. Prompts go to the provider you connect, under your account, and your agreement with that provider applies.
Protected webhooks
Secret headers, HMAC-SHA256 signatures, IP allowlists and required headers. Secrets can be rotated, and a generated secret is shown only once.
Scoped API keys and signed events
REST API keys carry only the scopes you tick, can expire, are stored as salted hashes and are shown once. Outbound webhooks are signed with HMAC-SHA256, sent only to public https addresses, and their secrets rotate with a 24-hour overlap.
Roles and least privilege
Seven roles from Owner to Viewer. People can only grant roles below their own, and only owners and admins can connect AI provider keys.
Account protection
Two-factor authentication with an authenticator app, and a list of signed-in devices you can sign out. Accounts are for people aged 18 and over, as our Terms require.
Guarded outbound calls
HTTP steps and custom AI endpoints can't reach private or local network addresses. Every server run has a time limit and a cap on estimated AI cost.
Activity log
Owners and admins see who did what in their workspace: edits, runs, approvals, invites, role and key changes, billing and exports. Entries can't be edited or deleted, and you can export them as CSV. Secrets and prompts are never recorded.
Your data
Take it with you. Or delete it.
You stay in control of what's in your workspace, and you can leave whenever you like.
Export
Owners and admins can download a JSON export: workspace, members, workflows, recent runs, and integration and credential metadata. Secret values are never exported.
Delete
The owner can delete a workspace at any time. Any paid plan is cancelled and the data is removed from our active systems immediately.
Cancel online
Cancel a paid plan in Billing whenever you like. No call, no email needed.
Privacy
No tracking you didn't ask for.
We keep tracking to what the service needs to work.
No session replay, no ad trackers
We don't record screens, clicks or keystrokes, and we don't use advertising pixels or sell your data.
Self-hosted fonts
Our fonts are served from our own servers, so pages make no requests to font services.
Only necessary cookies
The app uses cookies to keep you signed in, and Stripe uses its own on checkout and billing pages.
Details in our Privacy Policy.
Sub-processors
Who helps us run the service.
Each one receives only what it needs to do its job. We notify customers at least 30 days before adding a new one.
| Provider | What they do |
|---|---|
| Clerk | Sign-in, sessions and multi-factor authentication |
| Supabase | Primary Postgres database and file storage |
| Stripe | Payments, subscriptions and invoices. Card details go straight to Stripe. |
| Resend | Transactional email delivery |
| Vercel | Application hosting, CDN and request logs |
| Sentry | Error monitoring. Secrets, emails, cookies and IP addresses are removed before a report is sent. |
| Your AI providers | AI inference, processed under the provider account and key you connect, on your terms with them |
The complete, current list, with locations, is in our security docs. Contract terms are in the Data Processing Agreement.
What we don't have yet
We'd rather tell you now than have you find out in a security review.
No SOC 2 report yet
We follow common security practices, but we don't hold a SOC 2 report today. A security review is available on request.
Not HIPAA compliant
We don't sign Business Associate Agreements. Don't process protected health information in Fluxo Flow.
Not certified for payment card data
Don't send full card numbers through workflows. Payments for your plan are handled by Stripe, and we never see your card number.
Need a security review or questionnaire? Talk to sales or email security@fluxosuite.com.
Found a security issue?
Email security@fluxosuite.com with what you found, the steps to reproduce it, and how to reach you. We'll acknowledge your report and keep you updated while we fix it.
Please don't access other people's data, disrupt the service or run automated scans. Our Acceptable Use Policy requires our written consent before any testing beyond your own account.
FAQ
Security questions.
Do you train AI models on my data?
We don't train AI models, and we don't resell AI. AI steps run on the provider account you connect, so your agreement with that provider, including its training and retention settings, governs your prompts.
Who can see my API keys?
Credentials and AI keys you save are stored encrypted, and the full value is never shown again, not even to your workspace's owner and admins; Settings only shows a short hint. Fluxo Flow API keys are shown once when they're created and stored only as a salted hash, so nobody (including us) can read them back. Only owners and admins can create or revoke them, and each use is recorded in the activity log.
Where is my data stored?
Our main database and hosting providers are in the United States. The current sub-processor list, with locations, is in the security section of our docs.
How do I get my data out, or delete it?
Owners and admins can download a JSON export of the workspace from Settings, Danger Zone. The owner can delete the workspace there too, which removes it permanently from our active systems; encrypted backups age out after a limited period.
Do you have a DPA?
Yes. Our Data Processing Agreement covers GDPR and CCPA/CPRA terms, including Standard Contractual Clauses for international transfers, and is part of the Terms of Service.
Is Fluxo Flow SOC 2 certified or HIPAA compliant?
Not today. We don't hold a SOC 2 report, we aren't HIPAA compliant and we don't sign BAAs, and the platform isn't certified for payment card data.
Start free, with your own AI key.
Build and Dry Run on the Free plan, no credit card. Run live on a paid plan, on your own AI key at cost.
Free to explore · No credit card · 30-day money-back guarantee on paid plans