Security is built into how Flowviant is architected and operated. This page summarizes our practices. If you discover a vulnerability, please report it (see below) — we appreciate responsible disclosure.
Infrastructure
Flowviant runs entirely on Cloudflare's global network — application logic on Workers, the relational store on D1, and large objects on R2. We benefit from Cloudflare's DDoS protection, WAF, and physically secured data centers.
Encryption
- In transit. All traffic to and from the Service is encrypted with TLS.
- At rest. Data stored in our database and object storage is encrypted at rest by our infrastructure provider.
Authentication
Accounts and sessions are managed by Clerk, a dedicated authentication provider. We support OAuth sign-in with GitHub and Google, and we never store your password — it stays with the authentication provider.
Payments
All payments are processed by Stripe, a PCI-DSS Level 1 certified provider. Flowviant never sees or stores full card numbers.
Access and permissions
Integrations use scoped, revocable access. GitHub connections request only the repositories you authorize, and coding agents act under tokens you can revoke at any time. Within a project, access follows your organization's membership and seat allocation.
AI data handling
AI requests are sent to our model providers (Google Gemini and Anthropic Claude) only when you invoke an AI feature, and only with the context needed to fulfill the request. Under these providers' API terms, your content is not used to train their foundation models.
Backups and resilience
Our database supports point-in-time recovery, and our infrastructure is designed for high availability across Cloudflare's network.
Reporting a vulnerability
If you believe you've found a security issue, email [email protected] with details and steps to reproduce. Please give us a reasonable opportunity to address it before any public disclosure. We will not pursue action against good-faith research that respects user privacy and avoids service disruption.
Subprocessors
The third parties that process data on our behalf are listed in our Privacy Policy.