Trust

Security by design.

Last updated: June 13, 2026

1. What this page is

Every claim below is something you can check: in the public repository, or in the live configuration of this site. Where we cannot evidence a claim, it is not on this page. That is the whole policy, and it is why this page is shorter than the one it replaced.

FlowManner is operated by one person. There is no security team, no SOC 2 report, and no compliance certification. We would rather say that than imply otherwise.

2. Transport

TLS terminates at nginx on the edge. TLS 1.3 and TLS 1.2 are enabled.
HSTS is sent with max-age=31536000; includeSubDomains; preload.
The server no longer advertises its version (server_tokens off).
www redirects to the apex host in a single hop, so one canonical origin serves every page.

3. Your API keys

You bring your own LLM provider keys. They are encrypted at rest with a key-versioned Fernet scheme — AES-128-CBC with HMAC-SHA256 — not AES-256, and not a managed cloud KMS. We state the actual algorithm because the weaker-sounding one is the true one.
Keys are never stored or logged in plaintext, and are decrypted only in memory to make a request.
We do not have access to your provider credentials beyond holding the encrypted value.

The database itself is not application-level encrypted at rest. It runs on a single private host with no public route. Anyone needing full-disk or column-level encryption should treat that as a gap to raise with us, not assume it is handled.

4. Network and infrastructure

The database and application services are reachable only over a private WireGuard network. They have no public IP and no public listener.
The public edge is a single nginx instance. There is no WAF, no CDN, and no DDoS-mitigation service in front of it.
Services run as containers. There is a single point of failure: one operator, one host, one edge.

5. Abuse and rate limiting

Authentication endpoints are rate limited per client IP — sign-in at 5 per minute, registration at 3 per hour. Since September 2026 the limit is keyed on the real client address rather than the proxy hop, so one user cannot lock out everyone.
The edge discards any client-supplied X-Forwarded-For and substitutes the address it actually observed, so the per-IP limit cannot be evaded by forging a header.
A lockout is reported to the user as a lockout, with a retry time — not as a failed password.
Failed sign-ins trigger a per-account lockout after repeated attempts.

6. Audit logging

Authentication and administrative actions are written to an append-style audit log with the action, timestamp, endpoint, method, and client address.
Since September 2026 those rows record the real client IP. Previously every entry recorded the internal proxy address, which made the log far less useful than it appeared.
The log is not yet cryptographically tamper-evident. Treat it as an operator-visible record, not a third-party-attested one.

7. Reporting a vulnerability

If you find a security issue, email security@flowmanner.com with enough detail to reproduce it. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction, and service degradation.

We will confirm receipt and work with you on a fix. We cannot promise a specific remediation window or a formal safe-harbor programme, because there is no process behind that promise yet.

8. What this page deliberately does not claim

No SOC 2, ISO 27001, GDPR or CCPA certification. Data-subject export and deletion endpoints exist; that is a feature, not an audit.
No WAF, no third-party penetration test, no bug-bounty programme.
No patch SLA. Fixes ship when they ship.
No on-call rotation, dedicated incident team, or published post-incident reviews. Incident response is one person checking a log.
No uptime SLA, and no uptime figure, because a single host does not warrant one.

If you are running a security review that requires any of the above, this is the honest answer rather than a softer version of it. Ask and we will tell you what is feasible.

1. What this page is

FlowManner is operated by one person. There is no security team, no SOC 2 report, and no compliance certification. We would rather say that than imply otherwise.

3. Your API keys

You bring your own LLM provider keys. They are encrypted at rest with a key-versioned Fernet scheme — AES-128-CBC with HMAC-SHA256 — not AES-256, and not a managed cloud KMS. We state the actual algorithm because the weaker-sounding one is the true one.

Keys are never stored or logged in plaintext, and are decrypted only in memory to make a request.

We do not have access to your provider credentials beyond holding the encrypted value.

4. Network and infrastructure

The database and application services are reachable only over a private WireGuard network. They have no public IP and no public listener.

The public edge is a single nginx instance. There is no WAF, no CDN, and no DDoS-mitigation service in front of it.

Services run as containers. There is a single point of failure: one operator, one host, one edge.

5. Abuse and rate limiting

Authentication endpoints are rate limited per client IP — sign-in at 5 per minute, registration at 3 per hour. Since September 2026 the limit is keyed on the real client address rather than the proxy hop, so one user cannot lock out everyone.

The edge discards any client-supplied X-Forwarded-For and substitutes the address it actually observed, so the per-IP limit cannot be evaded by forging a header.

A lockout is reported to the user as a lockout, with a retry time — not as a failed password.

Failed sign-ins trigger a per-account lockout after repeated attempts.

6. Audit logging

Authentication and administrative actions are written to an append-style audit log with the action, timestamp, endpoint, method, and client address.

Since September 2026 those rows record the real client IP. Previously every entry recorded the internal proxy address, which made the log far less useful than it appeared.

The log is not yet cryptographically tamper-evident. Treat it as an operator-visible record, not a third-party-attested one.

7. Reporting a vulnerability

We will confirm receipt and work with you on a fix. We cannot promise a specific remediation window or a formal safe-harbor programme, because there is no process behind that promise yet.

8. What this page deliberately does not claim

No SOC 2, ISO 27001, GDPR or CCPA certification. Data-subject export and deletion endpoints exist; that is a feature, not an audit.

No WAF, no third-party penetration test, no bug-bounty programme.

No patch SLA. Fixes ship when they ship.

No on-call rotation, dedicated incident team, or published post-incident reviews. Incident response is one person checking a log.

No uptime SLA, and no uptime figure, because a single host does not warrant one.

If you are running a security review that requires any of the above, this is the honest answer rather than a softer version of it. Ask and we will tell you what is feasible.