Security Overview
1. Infrastructure
- Hosting: cloud infrastructure hosted in the European Union on SOC 2 Type II certified providers.
- Data residency: customer data is stored within the EU. Limited data may be processed outside the EU by AI providers under appropriate safeguards (see Sub-processors below).
- Backups: automated backups with point-in-time recovery.
2. Encryption
- In transit: all connections protected with modern TLS.
- At rest: data encrypted using industry-standard algorithms.
- Sensitive credentials: OAuth tokens and API keys are encrypted before storage.
3. Authentication and access control
- Industry-standard authentication with secure session management.
- Passwords protected with modern password hashing.
- Role-based access control (owner, admin, member, viewer).
- Multi-factor authentication available.
4. Multi-tenant isolation
Fluxi enforces strict tenant isolation at the database level. Every request is automatically scoped to the authenticated user's workspace. Cross-tenant data access is prevented by design.
5. Sub-processors
Fluxi uses a limited set of sub-processors for infrastructure, AI processing, and email delivery. The up-to-date list is provided to customers under our Data Processing Agreement (DPA) and is available on request at security@fluxilabs.com.
Transfers to sub-processors located outside the EEA are protected by Standard Contractual Clauses (SCCs). We notify customers of material changes to the sub-processor list at least 30 days in advance.
6. Integration security
- All third-party integrations use OAuth 2.0 where available.
- OAuth tokens and API keys are encrypted and scoped per user and workspace.
- Integrations request only the minimum permissions required.
- Users can revoke access at any time.
7. Application security
- Input validation on all endpoints.
- Protection against common web vulnerabilities (OWASP Top 10).
- Security headers and transport-layer protections.
- Rate limiting on authentication and sensitive endpoints.
- Regular dependency scanning and security reviews.
8. AI security
Fluxi's AI features are protected by dedicated controls over inputs and outputs to detect and prevent abuse, including content-injection attacks. Sensitive actions the AI can take are rate-limited and monitored. Controls apply consistently across any AI provider we use.
9. Monitoring and incident response
- Continuous monitoring of errors and anomalies.
- Security audit trail for platform activity; personal identifiers are not stored in clear text.
- Incident response process with customer notification within 72 hours, in accordance with GDPR.
- Periodic review and testing of security controls.
10. Data retention and deletion
- Customer data retained for the duration of the account.
- Account deletion triggers data removal within 30 days.
- Security audit data retained for a limited period, then pruned.
- Legal retention obligations (e.g., invoicing records) are preserved as required by law.
11. Compliance
- GDPR (EU General Data Protection Regulation).
- LOPDGDD (Spanish Data Protection Law).
- Critical sub-processors hold SOC 2 Type II attestations.
12. Contact
For security questions, sub-processor list requests, or to report a vulnerability, email security@fluxilabs.com.