Security

Encryption

• Every connection uses HTTPS (TLS), and browsers are told to use nothing else (HSTS).
• Stored reports, QuickBooks connection tokens and two-step sign-in secrets are encrypted with AES-256-GCM under keys kept apart from the data.
• The database and file storage are encrypted at rest by our hosting provider.
• Passwords are never stored — only an Argon2id hash of them.

Access

• Each organization’s data is visible only to its members. Every request is checked against the member’s organization and role.
• Six roles, from Owner to read-only Viewer, decide who may see and change what.
• Two-step sign-in with an authenticator app, which an Owner can require of everyone.
• Signing out, removing a member or ending a session takes effect at once, on every device.
• Sign-in attempts are rate-limited, and failed ones are recorded.

Your data and AI

• Every figure is calculated from your ledger by Beflow’s own engine; the AI explains and prioritises, citing the evidence.
• Customer and product names are replaced with stand-ins before anything is sent to the AI provider.
• Your data is not used to train AI models.

Payments

Payments are taken by Stripe on Stripe’s own pages. Beflow Decisions never sees or stores your card number — only its brand, last four digits and expiry, as Stripe reports them.

Accountability

• Every administrative action — invitations, role changes, settings, exports — is written to an audit log that cannot be edited or deleted.
• Owners and Admins can search it and export it as CSV or PDF.

Resilience

• The database is backed up every 15 minutes, files and settings nightly, encrypted, to storage at a separate provider.
• Daily, weekly and monthly copies are kept for a year, and a restore is tested every week.
• The platform’s health is checked every five minutes, and errors alert the team.

How we build

• Every change passes automated tests — unit, integration and in a real browser — before it is released.
• Every change is scanned for vulnerable dependencies, leaked secrets and vulnerable container images.
• The application is reviewed against the OWASP Top 10.

Reporting a vulnerability

If you believe you have found a security issue, write to us at the address on the Contact page with “Security” in the subject. We will reply promptly and keep you informed. Please do not test against other customers’ data.