Security

Last updated: August 16, 2026

Security is built into how the platform is designed and operated. This page summarizes the measures we take. It is a description of our practices, not a warranty.

1. Encryption

Traffic to and from the application is encrypted in transit with TLS. Data at rest in our database and backups is encrypted by our infrastructure providers.

2. Authentication

Passwords are stored hashed, never in plain text. Sessions are scoped to a workspace and expire after a period of inactivity. We encourage strong, unique passwords for every account.

3. Tenant isolation

Every request is scoped to the signed-in user's workspace, so one customer cannot read another customer's prospects, campaigns, or settings.

4. Secret handling

Credentials for connected services are stored server-side and are never exposed to the browser. Application secrets are held in the hosting environment, not in source code.

5. Least privilege

Access to production systems is limited to the people who need it, and third-party providers receive only the data required to perform their function.

6. Resilience

The database is backed up by our managed provider, and the platform runs on infrastructure with automated recovery so that a failed component restarts without manual intervention.

7. Reporting a vulnerability

If you believe you have found a security issue, please report it to security@fluxnoma.io. We welcome good-faith research, will investigate promptly, and ask that you avoid accessing other customers' data or degrading the service while testing.