Your data is safe with us
A plain-English summary of how we protect your business and your customers.
Every business is sealed off
- Every screen and request checks which workspace you belong to before it reads or changes anything.
- We test this automatically with around 60,000 cross-workspace requests; nothing may leak.
- The platform team sees counts and billing details only, never your customers' records.
Safe sign-in
- Passwords are never stored, only a salted one-way hash.
- Two-step sign-in with an authenticator app or an emailed code, plus recovery codes.
- Owners and admins must use two-step sign-in.
- Alerts for new devices and new countries; sign out any device in one click.
Sensitive data protected
- Identity numbers such as passport, NHS number and UTR are encrypted (AES-256) and masked.
- Every time someone presses Show, it's recorded in the activity log.
- Mailbox passwords and provider keys are encrypted and never sent back to the browser.
Email and files
- Incoming email is cleaned and shown in a locked-down frame.
- Dangerous file types are refused, and files are checked by their contents, not their names.
Bots and abuse
- Cloudflare Turnstile checks on sign-up, sign-in and public forms.
- Hidden trap fields, speed checks and rate limits.
Backups and your data
- The whole database is encrypted and backed up every night, with 30 daily, 12 monthly and 5 yearly copies.
- Download all your data as spreadsheets any time.
- GDPR tools: export or erase one person's data in a click.
Found a security problem? Please tell us at security@companyflowhq.com (see security.txt).
Try it with your own business
14-day free trial · No card needed · Cancel any time