How we protect your data.

Where your data is stored

Your account, canvases and uploaded data live in a Supabase database and Supabase storage, hosted on AWS in the region listed on the sub-processors page. The app itself runs on Vercel, in Singapore.

The full list of companies that process data for us, and what each one does, is on the sub-processors page.

See the sub-processors, the privacy policy, the cookie policy, the acceptable use policy and the data processing agreement.

Encryption

Every connection to FlowProofs uses TLS, and browsers are told to refuse anything else (HSTS). Data at rest in the database and in file storage is encrypted with AES-256 by our hosting provider.

Credentials for connected tools (OAuth tokens, API keys and database passwords) get a second layer: we encrypt them with AES-256-GCM before they are stored, and they are never sent back to the browser, not even to you.

Isolation between accounts

Every table in the database has row-level security switched on, so a query made with your session can only return your rows. On top of that, every request to our API checks who is asking and filters by your account in code.

The rows from your uploaded files sit in a separate database schema that no browser can reach. Only our server can read it, and only after confirming the table belongs to you.

Files you upload

Uploaded CSV and Excel files go into private storage, in a folder belonging to your account. They are never published at a public address; only our server reads them, to turn them into tables. Each file is checked to be the type it claims to be before it is stored.

One exception, stated plainly: images you place on a canvas are stored at long, unguessable public addresses, so they can load inside a shared canvas for viewers without an account. Do not put anything in an image you would not put in a shared link.

Sharing

Share links use long random addresses that cannot be guessed. You can add a password (stored only as a hash) and an expiry date, and switching a link off revokes it at once.

Client views remove hidden blocks and protected numbers on the server before the page is built, so they are not sitting in the page source for someone to find.

Connected databases

When you connect PostgreSQL, every query runs inside a read-only transaction with a time limit, and only tables you choose are read. Addresses on private networks are refused, so a connection cannot be pointed at internal infrastructure.

AI features

AI features are optional and only run when you use one, for example importing a PDF report or asking for a written summary. The text and numbers needed for that request are sent to Anthropic, which processes it and returns a result.

Under Anthropic's commercial terms, that data is not used to train their models. We do not train models on your data either. Explanations of why a number moved are calculated from your data, not generated by AI.

Deleting your data

Delete any file or canvas whenever you like; deleting a canvas also deletes the images on it. Deleting your account from Settings removes your canvases, your uploaded files and the tables made from them, your images and your connections. The account is locked at once and erased after 7 days, so a mistake can be undone; you can also choose to erase it at once.

Before you go, Settings can make one ZIP of everything: your account details, every canvas and your original files, behind a link that expires after 24 hours.

Reasonable security practices

These are the safeguards India's IT Act and the DPDP Rules call reasonable security practices, in plain words: encryption in transit and at rest; every account's data kept apart by row-level security and checked again in code; access to production limited to the people who run FlowProofs, with only the permissions each task needs; sign-in records kept for at least a year so misuse can be traced; backups; and a written plan for handling incidents.

No system is perfectly secure, and we do not claim ours is. We aim to find problems early, fix them quickly and tell you honestly.

If something goes wrong

If a security incident affects your data, we will tell you without delay: what happened, what it means for you and what we are doing. We report incidents to India's CERT-In within 6 hours of noticing them, and to the Data Protection Board of India and, where GDPR applies, the relevant supervisory authority within 72 hours.

Certifications

FlowProofs is not SOC 2 or ISO 27001 certified, and there is no such thing as a GDPR certification. We build to GDPR and DPDP principles and would rather tell you that than imply otherwise. If your company needs a security questionnaire answered, email us and we will answer it honestly.

Reporting a vulnerability

If you find a security problem, email security@flowproofs.com with the steps to reproduce it. We will reply and keep you updated while we fix it. Please do not access other people's data or disrupt the service while testing.