← Back to home

Security

How we protect your data and run the Service.

Last updated June 25, 2026

Security is built into how Flowviant is architected and operated. This page summarizes our practices. If you discover a vulnerability, please report it (see below) — we appreciate responsible disclosure.

Infrastructure

Flowviant runs entirely on Cloudflare's global network — application logic on Workers, the relational store on D1, and large objects on R2. We benefit from Cloudflare's DDoS protection, WAF, and physically secured data centers.

Encryption

  • In transit. All traffic to and from the Service is encrypted with TLS.
  • At rest. Data stored in our database and object storage is encrypted at rest by our infrastructure provider.

Authentication

Accounts and sessions are managed by Clerk, a dedicated authentication provider. We support OAuth sign-in with GitHub and Google, and we never store your password — it stays with the authentication provider.

Payments

All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Flowviant never sees or stores full card numbers.

Access and permissions

Integrations use scoped, revocable access. GitHub connections request only the repositories you authorize, and coding agents act under tokens you can revoke at any time. Within a project, access follows your organization's membership and seat allocation.

AI data handling

AI requests are sent to our model providers (Google Gemini and Anthropic Claude) only when you invoke an AI feature, and only with the context needed to fulfill the request. Under these providers' API terms, your content is not used to train their foundation models.

Backups and resilience

Our database supports point-in-time recovery, and our infrastructure is designed for high availability across Cloudflare's network.

Reporting a vulnerability

If you believe you've found a security issue, email [email protected] with details and steps to reproduce. Please give us a reasonable opportunity to address it before any public disclosure. We will not pursue action against good-faith research that respects user privacy and avoids service disruption.

Subprocessors

The third parties that process data on our behalf are listed in our Privacy Policy.