How Flow keeps your work private
Customer names, drawings and prices are commercially sensitive. These are the measures in place to protect them.
Separated by company
Every record belongs to one workspace. Every request is checked on the server against the signed-in person's workspace; asking for another company's job returns "not found", as if it did not exist.
Private files
Drawings and photos are stored in private storage. They open only through signed links that expire within minutes, issued after the same workspace check.
Encrypted in transit
All connections use HTTPS with HSTS. Connections from Flow to its database are encrypted too.
Strong sign-in
Passwords are hashed with PBKDF2-SHA256 at 600 000 iterations. Repeated failed attempts lock an account for 15 minutes. Changing a password signs out every other session.
Roles, enforced
Operators, supervisors, managers, administrators and owners can do different things, and every action is checked on the server, not just hidden in the interface.
An audit trail
Stage changes, assignments, status changes, uploads and deletions are recorded with who did them and when.
Web protections
Forms are protected against cross-site request forgery. A strict content security policy blocks injected scripts, and no third-party trackers are loaded.
Hard to lose by mistake
Jobs, projects and customers are archived rather than deleted. Permanent deletion requires an administrator to confirm by typing the job number.
Where data lives
Application, database and files are hosted in the European Union (Frankfurt) on Vercel and Neon. See the privacy notice.