Security
What we do, and what we do not claim.
How Intelliflow protects customer data, access to it, and the integrity of what it records.
These are engineering controls and architectural choices, verifiable in the product. They are not security certifications, and this page claims none.
Where each thing stops
The browser never talks to the database, nor to the service that holds the keys. That is a separation in code, not a guideline.
The browser
What the signed-in person sees. No provider key, no secret.
The web application
Shows the data and hands every write to the internal service.
The internal service
The only thing that writes. Checks permissions on every request, and holds the keys.
The database
Enforces isolation between customers itself, including against the owner of the tables.
The controls in place
Customer data isolation
Every table holding customer data carries a PostgreSQL row-level security policy, enforced even against the owner of the table. A test enumerates every table and fails if one of them is unprotected.
Audit trail
Update and delete rights are withdrawn from the application account. An administrator cannot rewrite the history from inside the product, and neither can we.
Secrets
AI provider keys never leave the server. The browser never talks directly to the internal service. Stored secrets are encrypted with a key derived per use.
Passwords and sessions
Argon2id for passwords, opaque tokens stored as a hash, and immediate server-side revocation. A reset ends every session.
Two-factor authentication
TOTP with protection against replaying a code already used, and single-use recovery codes stored as a hash.
Outbound messages
Messages are signed over the bytes exactly as sent, timestamp included. Every destination address is checked before sending, IP literals included.
What the AI receives
An assistant has no permissions of its own and reads with those of the person running it. With no relevant document, no model is called.
Our own access
Our platform account can read and cannot write anything. Any cross-customer read requires a reason, and that reason is recorded before the read.
What we do not claim
- We hold no security certification — no ISO 27001, no SOC 2, no HIPAA or GDPR compliance attested by a third party. We can, on the other hand, describe our architecture in detail.
- We show no customer logos, no testimonials and no case studies. We have none to show yet.
- We publish no performance or uptime figures until we have real measurements to quote.
- Intelliflow runs on a single server, brought online in September 2026. It has no customers yet and has never been operated at scale: we will publish availability figures when we have months of measurements behind them, not before.