Keep the right information with the right people.

01 / Security and access

Requirements to check before a rollout

Flowboard does not currently offer SOC 2 or ISO 27001 certification, HIPAA attestation or SAML single sign-on. You can sign in with email and password or a Google account. If your client requires one of those certifications or SAML, discuss that requirement with the team before onboarding.

For custom API connections, contact the team about the authentication route and records your system needs to access. Outbound webhooks support specific event notifications. The API and webhooks guide explains configuration, signatures and delivery checks for those connections.

02 / Security and access

Internal financial access and client identity

Staff cost-rate data is restricted to Owner and Admin roles in the financial workspace. Other roles may work with operational information without receiving those internal cost values. This separation supports delivery coordination without making every team member a recipient of the agency's underlying labor economics.

Client portal users have a separate identity model from internal workspace members and are associated with the relevant client context. The portal applies visibility rules to shared work. Tasks and comments must be appropriate for the client-facing scope, and files and documents require deliberate sharing. Use the client preview to inspect the experience before relying on it with an external stakeholder.

03 / Security and access

Audit records for supported workspace changes

The workspace audit log is available to Owner and Admin roles and provides pagination and filters. It records changes to tasks, task dependencies, comments, time entries, invoices, expenses, workspace settings and message threads. Recorded action categories include creation, update, deletion, status changes, and visibility changes.

This is useful when an authorized reviewer needs to investigate a supported change, such as a visibility update or a task status transition. For an audit requirement outside the listed records and actions, ask the team about coverage and the information available for your process.

04 / Security and access

Calendar credentials and personal-data export

Google Calendar OAuth tokens are stored using Fernet symmetric encryption. For questions about encryption of other data or infrastructure controls, send the team your requirements so we can address the specific information your client needs.

The personal-data export workflow runs as an asynchronous job and produces a downloadable archive when completed. Its generated download link has a 24-hour lifetime. The archive contains personal records within the user and workspace scope. It is a personal-data export, not a complete workspace backup or restore package.

05 / Security and access

A practical access review before inviting a client

A product control and a good sharing practice work together. The software can enforce a visibility choice, but it cannot know whether an author pasted confidential pricing into a document intended for the client.

1. Identify the required controls

   List mandatory client or agency requirements, including identity, certification, data handling, and audit expectations. Resolve missing capabilities before rollout.

2. Review member and client access

   Use the appropriate internal role and client association. Avoid granting broader access simply because it makes an initial setup easier.

3. Inspect shared content

   Check client-visible tasks, comments, documents, and files. Review the actual text and attachments for information that should remain internal.

4. Test the client experience

   Use the preview and relevant workflow checks. Repeat the review when access, project scope, or shared material changes.

06 / Security and access

Questions that deserve a specific answer

For procurement questions about hosting, retention, backup recovery, contractual processing terms, or a control not described here, contact the team with the exact requirement. Include any contractual requirements or deadlines in your question. The appropriate answer may depend on the current service arrangement and the evidence available for that requirement.

For a suspected security issue, contact security@flowboardhq.com with enough context to establish the concern. Keep passwords, reusable tokens, and unnecessary client data out of the initial email. Describe the affected workflow, when the issue occurred and the steps needed to reproduce it.