Your data deserves bank-grade protection.
Flowstack is built on enterprise-grade infrastructure with end-to-end encryption, two-factor authentication, and SOC 2 compliant hosting. Your business data is never exposed.
Bank-grade login protection.
Every Flowstack account is secured with verified email authentication and optional two-factor authentication — the same standards used by financial institutions.
Built on certified infrastructure.
Flowstack runs on Vercel's edge network with Neon PostgreSQL — both SOC 2 Type 2 certified, ISO 27001 audited, and regularly pen-tested by independent third parties.
Vercel Edge Network
Our application layer runs on Vercel — the same infrastructure trusted by OpenAI, PayPal, and The Washington Post. Automatic DDoS mitigation, Web Application Firewall, and edge-localised protection at every point of presence.
Neon PostgreSQL
All customer data is stored in Neon's serverless PostgreSQL — encrypted at rest with AES-256, encrypted in transit with TLS 1.2+, with AWS KMS key management and automatic key rotation.
End-to-End Encryption
Every byte of data is encrypted — at rest with AES-256, in transit with TLS 1.2+. Sensitive secrets like 2FA keys are encrypted with AES-256-CBC before storage. API keys are hashed, never stored in plaintext.
Your data. Your control.
We follow the principle of least privilege across everything — from API scopes to internal access.
Read-only Gmail access
Unlike competitors that request delete and send permissions, Flowstack only asks for gmail.readonly. We can never modify, delete, or send emails on your behalf.
Delete your data anytime
Full account deletion with type-to-confirm safety. When you delete, everything goes — contacts, emails, forms, submissions. No shadow copies.
API keys are hashed
Engine API keys are hashed before storage using SHA-256. Even in a breach scenario, raw keys cannot be recovered from the database.
Webhook signatures
All webhook deliveries are HMAC-signed so your endpoint can verify that payloads genuinely originated from Flowstack — not a third party.
Role-based access
Workspace roles (Owner, Admin, Member) with granular permissions. Control who can invite members, manage billing, delete data, or access API keys.
reCAPTCHA v3 protection
Public forms are protected by invisible reCAPTCHA v3 — scoring-based bot detection with no friction for real users. Keeps spam and automated abuse out.
What we've done. What's next.
All data encrypted on disk via Neon/AWS KMS
All connections secured via HTTPS/TLS
Passwordless login via Google, auto-verified
View and revoke active sessions from Settings → Security
Automatic mitigation via Vercel Edge Network
Verify webhook authenticity on your endpoint
Owner / Admin / Member permissions per workspace
Invisible bot protection on all published forms
Verification email via Resend, account locked until confirmed
Google Authenticator / TOTP app with backup codes
Security questions?
If you have specific security or compliance requirements, we're happy to discuss them.