Security

Your data is safe with us

A plain-English summary of how we protect your business and your customers.

Every business is sealed off

  • Every screen and request checks which workspace you belong to before it reads or changes anything.
  • We test this automatically with around 60,000 cross-workspace requests; nothing may leak.
  • The platform team sees counts and billing details only, never your customers' records.

Safe sign-in

  • Passwords are never stored, only a salted one-way hash.
  • Two-step sign-in with an authenticator app or an emailed code, plus recovery codes.
  • Owners and admins must use two-step sign-in.
  • Alerts for new devices and new countries; sign out any device in one click.

Sensitive data protected

  • Identity numbers such as passport, NHS number and UTR are encrypted (AES-256) and masked.
  • Every time someone presses Show, it's recorded in the activity log.
  • Mailbox passwords and provider keys are encrypted and never sent back to the browser.

Email and files

  • Incoming email is cleaned and shown in a locked-down frame.
  • Dangerous file types are refused, and files are checked by their contents, not their names.

Bots and abuse

  • Cloudflare Turnstile checks on sign-up, sign-in and public forms.
  • Hidden trap fields, speed checks and rate limits.

Backups and your data

  • The whole database is encrypted and backed up every night, with 30 daily, 12 monthly and 5 yearly copies.
  • Download all your data as spreadsheets any time.
  • GDPR tools: export or erase one person's data in a click.

Found a security problem? Please tell us at security@companyflowhq.com (see security.txt).

Try it with your own business

14-day free trial · No card needed · Cancel any time