Security at Flowback.
Your customers trust you with their feedback, and you trust us to look after it. This page is our trust center: our security practices, subprocessors, and disclosure policy in one place.
Infrastructure & hosting
Flowback runs on Vercel, with data stored in Supabase's managed Postgres. All traffic is served over TLS, and data is encrypted at rest and in transit.
Data isolation
Every workspace's data is isolated with Postgres row-level security policies enforced at the database layer, not just in application code. Scoped API and MCP tokens grant access to a single workspace, and every token records when it was last used.
Authentication
Sign in with Google, GitHub, or email. Sessions and credentials are managed by Supabase Auth; passwords are stored with industry-standard hashing and are never visible to us.
Payments
Billing is handled end to end by Stripe. Card details go straight to Stripe and never touch our servers; Flowback stores only the subscription state needed to run your plan.
AI processing
Feedback is processed by large language models to structure, cluster, and summarise it. Our AI providers process this data to serve your requests only and do not train their models on it.
Abuse protection
Public intake pages and the embeddable widget are protected by Cloudflare Turnstile, and API endpoints are rate limited.
Your data, your call
You can export your issues at any time via the API or MCP server. If you leave, contact us and we will delete your workspace data.
Subprocessors
We use a small number of service providers to run Flowback:
- VercelApplication hosting and delivery
- SupabaseDatabase, storage, and authentication
- StripePayments and billing
- AnthropicAI processing of feedback
- CloudflareBot and abuse protection
- PostHogProduct analytics
- ResendTransactional email
Reporting a vulnerability
Found something? We want to hear about it. Reach us through the contact page and we will respond quickly. Our security.txt has the machine-readable version.