Skip to content
Customer FlowCustomerFlow
Customer FlowCustomerFlow

Security

How Customer Flow protects your company data

Your shipments, invoices, payroll, and documents are sensitive. This page explains the protections built into the product, in plain terms.

  • Company data stays separate

    PostgreSQL row-level security keeps each organization's records apart at the database level, and the application connects with a restricted role rather than as the database owner.

  • People only see what they should

    Roles and permissions control who can see and do what in the workspace. Each team member gets their own account, and invites are per person.

  • Sign-in is protected

    Passwords are stored as bcrypt hashes, never in plain text. Two-factor sign-in works with an authenticator app or SMS code, and repeated sign-in attempts are rate limited.

  • Sessions can be ended

    Sessions use HttpOnly cookies that are sent only over HTTPS in production. Signing out revokes the session on the server, not only in the browser.

  • Data is encrypted in transit

    Traffic reaches the service over HTTPS with TLS certificates, and the site tells browsers to stay on HTTPS.

  • Sensitive fields get extra protection

    Two-factor keys, integration passwords, staff bank account numbers, and national ID numbers are encrypted by the application before they are saved.

  • Changes leave a record

    The audit trail records who created, changed, or deleted a record, and when. You can export an audit pack from the operational file when someone asks.

  • Your data stays yours

    You keep the rights to your data. Raw Data Export extracts your records to a file, and we do not use your documents to train public machine-learning models.

Running a security review?

Ask us for these details and we will answer for your review:

  • Where your data is hosted
  • Backup and recovery arrangements
  • A data-processing agreement
  • Certifications and third-party assessments
Ask a security question

Security questions

Can another company see our data?

No company can see another's workspace in normal use. Each organization's records are isolated at the database level, and roles control access inside your own workspace.

Does Customer Flow support two-factor sign-in?

Yes. Users can sign in with a second factor from an authenticator app or an SMS code.

Can we export our data?

Yes. Raw Data Export extracts your records to a file, and audit packs can be exported from the operational file.

How do we report a security issue?

Email support@thecustomerflow.com with the details and steps to reproduce it.

Read the Privacy Policy for how we handle personal data.