Skip to content

Security at Flowmap

This overview describes how Flowmap protects customer data across transmission, storage, access, application security, and operations.

See our approach Contact security

How we protect Flowmap

Defense in layers.

No single control carries the whole system. We use overlapping safeguards across data, identity, application code, and day-to-day operations.

  1. 01

    Data protection

    Traffic to Flowmap is protected using TLS 1.2 or later. Sensitive credentials and integration secrets are encrypted at rest using AES-256-GCM.

    TLS 1.2+ in transit · AES-256-GCM at rest

  2. 02

    Controlled access

    Organization boundaries, authenticated sessions, and role-based permissions help keep each person focused on the work they are meant to see.

    Organization-scoped · Role-based

  3. 03

    Application safeguards

    Secure browser headers, request-forgery protection, signed tokens, and server-side validation are built into the application layer.

    Protected requests · Validated inputs

  4. 04

    Operational care

    Monitoring, structured error reporting, backup procedures, and supervised runtime processes support the system beyond a single request.

    Monitored · Recoverable

Privacy and compliance

GDPR CCPA

Flowmap’s data protection practices are designed to support applicable GDPR and CCPA requirements. Our Data Processing Addendum includes processor, service-provider, international-transfer, and data-subject assistance terms.

From input to action

Protection follows the journey.

The safeguards around your data do not stop at the form. They continue as work moves through Flowmap and into the services you connect.

1

Enters securely

TLS 1.2 or later protects information while it travels between the browser and Flowmap.

2

Stays in context

Authenticated, organization-scoped access governs who can work with it.

3

Connects carefully

Connected-service credentials are encrypted before storage.

Identity and access

The right access, for the right people.

Access is protected through authenticated sessions, organization membership, and role-based permissions.

  • Authenticated sessions protect account access
  • Organization membership scopes access to the appropriate team
  • Organization and role checks protect application actions
  • Sessions use signed, same-site browser cookies

Responsible disclosure

Found a security concern?

Please send us a clear description and the steps needed to reproduce it. We’ll review the report and follow up with you.

security@flowmap.com