Security

Flowjat connects to your ad accounts and your revenue tools to give you plain-language advice on what to change. That means we handle sensitive things: OAuth tokens, campaign data and revenue numbers. This page describes — honestly — the security practices we have in place today and the ones we are still building.

We are an early-stage product and we will not pretend otherwise. We do not hold formal certifications such as SOC 2 or ISO 27001 today, and we will not claim badges we have not earned. What follows is a truthful description of how the product works now, and where we are actively investing.

Encryption in transit

All traffic between your browser, our application and our APIs is served over HTTPS using TLS. We do not serve the application over unencrypted HTTP. Calls we make to upstream ad and revenue platforms (Meta, Google Ads, TikTok, Snapchat, Apple Search Ads, Stripe, Paddle, RevenueCat) are likewise made over TLS-encrypted connections.

How we store OAuth tokens and secrets

When you connect an ad platform or a revenue tool, we receive an OAuth access token (and, where the platform supports it, a refresh token) on your behalf. We treat these credentials as our most sensitive asset:

• Tokens are stored encrypted at rest, not in plain text alongside the rest of your data.
• We request the narrowest OAuth scopes a feature actually needs, rather than broad "manage everything" permissions, and we tell you which platform you are connecting before you authorise it.
• We never ask for, and never store, the passwords to your ad or revenue accounts. Connections always go through the platform's official OAuth flow, so you grant and revoke access on the platform's side.
• You can disconnect an integration at any time; we delete the associated tokens when you do.

Application secrets and API keys (for example the credentials used to talk to our database, our AI provider and the ad platforms) are kept in managed secret storage and environment configuration, not committed to source control.

Least privilege

We aim to give every component — and every person — only the access it needs to do its job. The copilot reads the campaign and revenue data required to produce a recommendation; it does not get standing access to anything else. Access to production systems is limited to the people who need it to operate the service, and we keep that group small precisely because the team is small.

Data isolation between accounts

Your data is logically isolated per account. Our database is PostgreSQL on Supabase, and we use row-level security (RLS) policies so that queries can only return rows that belong to the authenticated account. This is enforced at the database layer rather than relying solely on application code, which reduces the risk that a bug in the app could expose one customer's data to another.

Hosting and data location

Our back-end — authentication and the database where your data and connected-account tokens live — runs on a self-hosted Supabase instance located in the European Union. The front-end is delivered through Vercel's global CDN. Some of the platforms we integrate with, and the AI provider that powers the copilot, operate outside the EU; we list every processor we rely on, what it does and where it is located on our subprocessors page.

Backups

The database is backed up so that we can recover from data loss or corruption. Backups inherit the same EU hosting location and encryption protections as the primary database. We continue to refine our backup cadence and our recovery testing as the product matures.

Application and access security

• Authentication is handled by Supabase Auth; sessions are managed with tokens rather than long-lived credentials embedded in the page.
• We keep our dependencies and platform up to date and review changes before they ship to production.
• We design features so the AI copilot suggests actions and explains them in plain language — you stay in control of what actually gets changed on your ad accounts.

What we have not done yet

Being honest about this matters more than looking polished:

• We do not yet hold SOC 2, ISO 27001 or comparable third-party audit certifications.
• We have not yet published a track record of formal security audits or penetration tests.
• Our incident-response and monitoring processes are still being formalised as the team and customer base grow.

These are areas we intend to strengthen. We would rather tell you where we stand today than imply maturity we do not have.

Responsible disclosure

If you believe you have found a security vulnerability in Flowjat, we want to hear from you. Please email security@flowjat.com with enough detail for us to reproduce the issue. We ask that you:

• give us a reasonable amount of time to investigate and fix the issue before disclosing it publicly;
• avoid accessing, modifying or deleting data that is not your own, and avoid degrading the service for other users;
• do not run automated scanning that could disrupt the service for other customers.

We will acknowledge legitimate reports and keep you updated on our progress. We do not currently run a paid bug-bounty programme, but we are grateful to researchers who report issues responsibly.

Questions

For security questions, email security@flowjat.com. For questions about how we handle personal data, see our Privacy Policy, or contact privacy@flowjat.com.