Last updated: September 24, 2026
1. Scope and how to read this document
This document describes the technical and organizational security measures that Harbor Software LLC applies to Flowboard, covering the application at app.flowboardhq.com and the API behind it. "Customer" means the business that accepted the Terms of Service, and "Customer Content" means the data that the Customer, its team members and its client users put into the Service.
Every control stated here is in place in the Service and has been checked against its code and configuration. Where a measure depends on one of our providers rather than on Flowboard's own code, we say so and name the provider. Where we cannot evidence a control to that standard, we do not claim it, and section 3 lists it so that its absence is stated rather than implied.
2. What Flowboard does not have
Flowboard does not currently hold SOC 2 or ISO 27001 certification or HIPAA attestation, and it does not offer SAML single sign-on. There is no third-party audit report to share. The Acceptable Use Policy prohibits placing regulated data into the Service, including protected health information and payment card data, because Flowboard is not built or certified for it. If a certification, SAML or an independent assessment is a requirement for you or your client, resolve it before onboarding.
3. Controls this document does not claim
These controls are common in documents of this kind. We do not claim them, because they are not in place or because we cannot yet evidence them to the standard in section 1. Read their absence as no commitment.
| Control | Position in this document |
|---|---|
| Penetration testing, bug bounty program | Not claimed. |
| Database-level row security | Not claimed. Tenant isolation is enforced in the application (section 7). |
| Encryption at rest at infrastructure providers | Not claimed by Flowboard (section 8.2). |
| TLS protocol versions, encryption between provider services | Not stated (section 8.1). |
| Multi-factor authentication for team sign-in | Not claimed. |
| Recovery point and recovery time objectives | Not stated (section 12). |
| Automated dependency vulnerability scanning, remediation timelines | Not claimed. |
| Personnel background checks, security training, managed devices | Not claimed. |
| Log retention periods | Not stated. Set by our providers. |
4. Governance and reporting
Harbor Software LLC is responsible for the security of the Service. We may change these controls as technology, threats and the Service change, but we will not materially reduce the overall level of protection they give Customer Content during a Customer's subscription, and we update this document when a control it states changes.
Our security contact is security@flowboardhq.com. It is also published in a security.txt file at /.well-known/security.txt on flowboardhq.com and app.flowboardhq.com. To report a suspected vulnerability or security incident, describe the affected workflow and how to reproduce the issue, and leave passwords, reusable tokens and unnecessary client data out of the message. Section 3 of the Acceptable Use Policy requires our prior written permission before anyone probes, scans or tests the security of the Service.
5. Authentication
5.1 Team members
Team member sign-up, sign-in and sessions are provided by Clerk, our authentication provider. Flowboard does not store team member passwords. The application verifies each session token against Clerk's published signing keys, and every route that is not public requires a valid session.
5.2 Client users
Client users of the client portal have an identity store separate from team members, keyed to the client record. A client user signs in with a password or with a magic link sent by email, which is valid for 24 hours and limited to five requests per hour for each email address. Portal passwords are stored as bcrypt hashes. Portal sessions last up to 30 days, and their tokens are stored as SHA-256 hashes.
5.3 API keys and webhooks
Flowboard API keys are stored as SHA-256 hashes. Inbound webhooks from our authentication and payment providers are verified by signature before they are processed, and inbound automation webhooks are verified with HMAC. Outbound webhooks to endpoints you configure are signed with HMAC-SHA256 so that the receiving system can verify them.
6. Access control
6.1 Workspace roles and permissions
Each workspace has five roles, Owner, Admin, Manager, Member and Viewer, with a configurable set of permissions. Financial data, including staff cost rates, is controlled by a financial permission that Owners and Admins hold by default. A workspace can grant that permission to other roles, and those roles then see the financial data it controls.
6.2 Client portal visibility
The client portal shows a client user only the tasks that the workspace marks as client-visible or client-editable, and only the comments marked client-visible.
6.3 Flowboard staff access
Flowboard has an administrative console for operating the Service, restricted by allow-lists enforced in both the web application and the API. The console can list users, read a workspace's audit log including the recorded changes, disable, enable and delete workspaces, and change plans. Console actions are recorded in an administrative audit log with the acting administrator and their IP address. Its impersonation action records an audit entry and does not create a session as the user. Database access by Flowboard operators through our hosting provider sits outside the application and is not recorded in these logs.
7. Tenant isolation
All workspaces share one multi-tenant database. Isolation between workspaces is enforced in the application: each workspace API route checks that the caller is a member of the workspace and scopes its queries to that workspace's identifier.
8. Infrastructure and encryption
8.1 Where the Service runs
| Provider | Role in the Service |
|---|---|
| Railway | Runs the API, the background worker, the database and the cache, in its Netherlands (EU) region. |
| Vercel | Hosts the web application frontend at app.flowboardhq.com. |
| Cloudflare | Operates the edge proxy in front of the API, and R2 object storage for uploaded files and exports, in its Asia-Pacific region. |
| Clerk | Provides team member authentication. |
| Sentry | Receives error reports from the API and worker, in the United States. |
| Resend | Sends transactional email, from the United States. |
| PostHog | Provides product analytics, in the United States. |
The sub-processors page lists the data each provider receives. Controls those providers operate, including the physical security of their data centers, are theirs, and this document does not restate them.
8.2 In transit and at rest
The web application is served over HTTPS and sends a Strict-Transport-Security header, set for two years, covering subdomains and eligible for browser preload lists, so that browsers use HTTPS on later visits. TLS connections are terminated by Vercel for the web application and by Cloudflare for the API. This document does not state which TLS versions they negotiate, and makes no claim about encryption between our providers' internal services.
Customer Content is stored in the database on Railway and in object storage on Cloudflare R2. Encryption of stored data at those providers is their control, not a function of Flowboard's code, and this document makes no independent claim about it.
8.3 Credentials held by Flowboard
| Credential | How Flowboard holds it |
|---|---|
| OpenRouter keys for AI Features | Encrypted at rest with application-level encryption, using an encryption key held separately from the database. Never returned to the browser after saving. See the AI Features Addendum. |
| Client portal passwords | Stored as bcrypt hashes. |
| Portal session tokens, Flowboard API keys | Stored as SHA-256 hashes. |
| Team member passwords | Not stored by Flowboard. Held by Clerk. |
| Payment card numbers | Not received or stored. Cards are entered on payment pages hosted by Stripe. |
| Google Calendar access and refresh tokens | Encrypted with Fernet symmetric encryption when the Google Calendar integration is enabled. |
| Portal magic-link tokens, webhook signing secrets | Stored without application-level encryption. Magic links expire after 24 hours. Webhook secrets must be readable to compute signatures. |
| Tokens for importing from another tool | Held for up to 2 hours in the job cache without application-level encryption. |
9. Logging, monitoring and audit
9.1 Workspace audit log
The workspace audit log records creation, update, deletion, status changes and visibility changes for tasks, task dependencies, comments, time entries, invoices, expenses, workspace settings and message threads, and Owners and Admins can read it. It does not record changes to projects, members, clients, files, proposals or CRM records, or client portal access and sign-ins.
9.2 Operational logs and monitoring
The API writes structured request logs recording the method, path, request identifier, status and duration of each request. Some operational log lines also record an email address, for example when a transactional email is sent. The text of AI search and compose requests is not logged. Errors in the API and worker are reported to Sentry. An automated health check tests the API every 15 minutes, and the status page reports the status of the Service.
9.3 Rate limits
Requests to workspace API routes are limited to 1,000 per minute for each workspace while the rate-limiting cache is available, and portal magic-link requests to five per hour for each email address.
10. Application security
The Service's continuous integration pipeline runs static security analysis of the backend code and fails when it reports a high-severity finding, and checks for missing and unused dependencies. The web application sends security headers including a Content Security Policy, X-Content-Type-Options, a Referrer-Policy, a Permissions-Policy, and X-Frame-Options set to deny framing on every page except client portal form pages.
11. Customer-directed transfers
Some data leaves the Service because the Customer directs it, not because we chose a vendor: outbound webhooks and automation calls to endpoints the Customer configures, imports the Customer runs from another tool with its own token, and the AI Features, which run on the Customer's own OpenRouter account.
12. Availability, backups and recovery
We target 99.9% uptime, as section 2.4 of the Terms of Service states. That is a target, not a guarantee, and there are no service credits.
The production database is backed up daily, with each daily backup retained for 7 days, and weekly, with each weekly backup retained for 28 days. Every backup ages out within 30 days of being taken. We have documented the restore procedure and tested it by restoring a backup to a staging environment. This document does not state a recovery point objective or a recovery time objective.
13. Security incidents
We maintain a written incident response runbook covering triage, containment, customer notification and a record of each incident. If we become aware of a personal data breach affecting a Customer's data, we will notify that Customer without undue delay and in any event no later than 72 hours after we become aware of it. The Data Processing Addendum sets out what the notice contains and how we assist afterwards. Report a suspected incident to security@flowboardhq.com.
14. Deletion and export
14.1 Deleted records
Most records deleted in the application, including tasks, projects, clients, invoices, comments, messages, file records and CRM records, are first held in a recoverable deleted state, and a daily job permanently removes them from the database 30 days after deletion. Deleting an individual file directly also removes its stored contents.
14.2 Deleting a workspace
An Owner can delete a workspace in Settings. Deletion is immediate and cannot be undone, so Settings prompts the Owner to export the workspace first. After a subscription is cancelled or ends for non-payment, the Owner has 30 days to request an export by emailing support@flowboardhq.com. Within the following 30 days, we permanently delete the workspace's database records, its stored files and its exports. Backups containing deleted data age out within 30 days, as section 12 describes.
14.3 Workspace export
The Owner of a workspace can request a workspace export from Settings. It produces a portable copy of your workspace data as CSV and JSON: a ZIP file containing a CSV file for each type of record, a workspace.json file, and a manifest of stored files with signed download links. The contents of stored files are available through those links and are not included in the ZIP. The Owner is emailed when the export is ready or if it fails, and the download link and the file links are valid for 7 days. A workspace can run one export at a time, and up to five in any 24 hours. After a subscription is cancelled, support can run an export for the former Owner. Form submissions, reports, time reports and analytics can also be exported as CSV where they appear. An individual who wants a copy of their own personal data should email privacy@flowboardhq.com.
15. Customer responsibilities
- Give each person the lowest role that fits their work, and review who holds the financial permission if you change its default.
- Remove team members promptly when they leave or no longer need access.
- Check what is marked client-visible, including the text and attachments of shared material, before inviting a client user.
- Keep regulated data out of the Service, as the Acceptable Use Policy requires.
- Protect the credentials you hold, including API keys, webhook secrets and any OpenRouter Key, and verify outbound webhook signatures at your endpoint.
- Export your workspace before you delete it, and secure your team members' sign-in accounts and devices.
- Report a suspected compromise to security@flowboardhq.com promptly.
16. Changes and contact
The current version of this document is always posted on this page with its last updated date. Security questions and reports go to security@flowboardhq.com. The security page summarizes Flowboard's access controls for day-to-day evaluation.