Security Overview
Last updated: October 14, 2026
A factual summary of the technical and organizational measures built into AACFlow. Each statement below can be checked against the source code; we do not make claims we cannot verify.
INTERNAL WARNING (not for production): this legal page still contains owner placeholders or test data (highlighted [[TO BE FILLED: ...]] markers or test company data). It must not go live in this state. Run `bun run scripts/check-legal-placeholders.ts` to list them.
1. Built-in controls
| Area | What the platform does | Where in the code |
|---|---|---|
| Encryption of stored secrets | Environment variables and API keys that you store are encrypted at the application layer with AES-256-GCM using a server-held key before they are written to the database. | lib/core/security/encryption.ts |
| Authentication | Email/password and email one-time-code sign-in; optional SSO (per deployment flag) for organizations on eligible plans; Cloudflare Turnstile bot protection when configured. | lib/auth/auth.ts, ee/sso, lib/core/security/turnstile.ts |
| Sessions | Server-side sessions with a 30-day maximum lifetime; organization admins on eligible plans can set a stricter session policy. | lib/auth/auth.ts, ee/session-policy |
| User provisioning | SCIM user provisioning is available for enterprise organizations. | ee/scim |
| Access control | Workspace and organization role-based permissions; credential groups and access control lists on eligible plans. | ee/access-control, ee/credential-groups, packages/platform-authz |
| Audit logs | Security-relevant actions (billing, membership, credentials) are written to an audit log; an audit-log viewer is available on eligible plans. | packages/audit, ee/audit-logs |
| Outbound request protection | Server-side requests made by workflows are checked against SSRF rules (private/loopback ranges, redirect policy, pinned DNS) before they leave the platform. | lib/core/security/url-safety.ts, lib/core/security/egress |
| Browser hardening | Content-Security-Policy and same-origin checks are applied to application routes. | lib/core/security/csp.ts, same-origin.ts |
| Log redaction | Sensitive keys and values are redacted from logs and traces by a central redaction utility. | lib/core/security/redaction.ts |
| Data retention controls | Configurable data-retention settings for organizations on eligible plans. | ee/data-retention |
| Payments | Card data is entered at Stripe (or Robokassa/Tochka for Russian customers) and is not stored by AACFlow. | lib/billing/payments |
2. What we do not claim
We do not currently claim any third-party certification (ISO 27001, SOC 2), penetration-test report, uptime SLA figure or specific backup/restore objectives on this page. Backups, hosting-level encryption at rest and network controls depend on the deployment and the infrastructure provider. [[TO BE FILLED: Owner - describe backup frequency/retention, database encryption at rest, hosting location and access controls of the production deployment once confirmed.]]
3. Reporting a vulnerability
Please report vulnerabilities to security@aacflow.io (or legal@aacflow.io) and give us reasonable time to fix them before disclosure. Scope and safe-harbor details are in section 16 of the Privacy Policy.
4. Your responsibilities
Use strong, unique passwords, enable SSO where available, rotate API keys, restrict workspace permissions to what is needed and review audit logs. See the Acceptable Use Policy and the DPA for shared-responsibility terms.
