Security isn't a marketing page for us — FlowForge exists to make software more trustworthy, so we hold ourselves to the same bar. Below is what we actually do today, described specifically rather than in generic "bank-level encryption" language, and — just as importantly — what we don't yet claim.
1. Encryption in transit
All traffic to flowforgesoft.com is served over HTTPS. Our CDN redirects
any plaintext request to HTTPS and enforces a minimum TLS version of 1.2,
so no content is ever served over an unencrypted connection. We also send
a two-year HTTP Strict Transport Security header (with
includeSubDomains and preload), which instructs
browsers to skip the plaintext redirect entirely on future visits.
2. Payment security
Checkout runs on Stripe's own hosted payment page. FlowForge's servers never receive, process, or store your card number, expiration date, or security code — that data goes directly to Stripe, keeping our own systems out of the scope of handling cardholder data.
3. Account and data access control
Every table that holds customer data has row-level security enabled and enforced — there is no table a client can query without a policy deciding what it's allowed to see. Your account, billing, and license records are readable only by you. Team-oriented data — the tickets and usage records that make sense to share within a project — is readable by members of that project or organization, never by anyone outside it. Writes to sensitive tables (entitlements, billing status, session leases) don't go through direct client access at all — they go through server-controlled procedures we define, so the client can request an action but can't directly rewrite the underlying record.
4. License and session integrity
FlowForge enforces a single active session per license using a server-issued lease. The lease token is stored hashed (SHA-256), not in plain text, and entitlement checks are evaluated server-side rather than trusted from the client — so a modified client can't grant itself access it wasn't issued.
5. Secrets management
Payment-processor and database service credentials live in our cloud provider's secrets manager and in server-side function environments — never committed to source control and never shipped in the JavaScript bundle your browser downloads.
6. Billing event integrity
Subscription status changes (payment succeeded, subscription updated, payment failed) arrive from Stripe via webhook. We verify the cryptographic signature on every webhook event before acting on it, so a request that didn't actually come from Stripe can't alter your subscription status.
7. No third-party trackers
flowforgesoft.com and the FlowForge product do not load third-party analytics, advertising, or session-replay scripts. We don't share your browsing or product-usage behavior with an ad-tech or analytics vendor, because we don't send it to one in the first place. FlowForge does record first-party time-tracking and usage data to power the product's own reporting feature — see Privacy Policy §2.3 — but that data stays inside our systems.
8. What we don't yet claim
In the interest of not overstating our posture: FlowForge does not currently hold SOC 2, ISO 27001, or any other third-party security certification, and we have not yet completed a third-party penetration test. These are on our roadmap as the company grows, and we'll update this page when they're real rather than claim them early. What we do have today is a documented internal threat model covering our licensing and entitlement system, and internal security reviews of the systems described above — real work, just not a substitute for outside certification.
9. Reporting a security issue
If you believe you've found a security vulnerability in FlowForge, we want to hear from you. Email alex@flowforgesoft.com with details and, if possible, steps to reproduce it. We'll acknowledge your report and work with you on a fix before any public disclosure.
10. Related reading
See our Privacy Policy for what information we collect and why, and our Terms of Service for the terms governing your use of FlowForge.