Security

Supabase Auth with email/password. Passwords are hashed (bcrypt) and never stored in plain text. Sessions use HTTP-only, Secure (production) cookies with SameSite=Lax. All login, signup, and password-reset traffic is encrypted in transit (TLS). Reset links use one-time PKCE codes that expire after 30 minutes; after verification you must set a new password before accessing your account.

PostgreSQL row-level security ensures users can only read and write their own flows, analyses, and migrations.

Data encrypted in transit (TLS) and at rest via Supabase infrastructure. API keys stored as environment variables, never in code.

Workflow content is sent to Anthropic Claude API for analysis and migration. We do not train models on your data, and uploaded content is treated as untrusted — embedded instructions are never executed. Review Anthropic's data usage policy for API customers.

Stripe handles all payment data. FlowShift never stores credit card numbers.

Delete individual flows or your entire account on request. Contact support@flowshift.org for account deletion.