Security

FlowManual is a document analysis platform for construction contractors. We treat your contracts, quotes, and invoices as the sensitive business records they are. Your data is encrypted, scoped to your own account, and never used to train models unless you explicitly opt in from your account settings. For organization workspaces, an admin can grant that permission on the company’s behalf, and any member can opt their own account out at any time; the individual opt-out always wins. Either way, Anthropic’s zero-retention policy means your text is never used to train their models. This page describes what the product does today, with anything not yet in place marked as roadmap.

Encryption everywhere

• In transit: All traffic runs over HTTPS with TLS 1.2 or higher. HTTP requests are redirected to HTTPS automatically, and HSTS is served so browsers only ever connect over a secure channel.
• At rest: File bytes and sensitive database fields are encrypted with AES-256-GCM. Each file gets its own key and each record gets its own key, both derived per item with HKDF-SHA-256, so a single key never protects the whole store.
• Searchable fields: Columns we need to look up by (such as names) use keyed HMAC blind indexes, so search works without storing the plain value in a searchable form.

Sign-in and access control

• Sign in with Google or email and password. Passwords are hashed with scrypt (memory-hard, OWASP-recommended parameters) and are never stored in plaintext.
• Optional two-step email verification. Turn on a one-time code sent by email for an extra check at sign-in. New browsers are recognized after the first verified sign-in, so you are not asked for a code every time on a device you already trust.
• Brute-force protection. Sign-in attempts are rate limited per address, and an account locks for fifteen minutes after ten consecutive failures.
• Role-based project access. Every project uses four roles: owner, admin, editor, and viewer. Access is checked on every request against the specific project.
• Activity log. Analysis activity is recorded and viewable to administrators.

Enterprise single sign-on (SAML 2.0 and OIDC) through your own identity provider, such as Microsoft Entra ID or Okta, is available; your identity provider’s sign-in and multi-factor policy then governs access. Roadmap: directory-based provisioning (SCIM).

Your data stays yours

Every read and every write is scoped to your account and your projects. One company’s documents are never visible to another, and there is no cross-tenant lookup. Sharing inside your own company is opt-in and invite-only: an organization workspace shares selected pricing and rate libraries between teammates only when an admin turns a library on and each member chooses to contribute, and every member can leave or stop sharing at any time.

When you run document analysis, only the extracted plain text is sent to the analysis provider, under a zero-retention, no-training policy; your original files are never sent to the analysis provider. Document parsing (reading layout, tables, and text out of an uploaded PDF) may be performed by Microsoft Azure Document Intelligence in the United States, which receives the document file for that purpose only, does not train on it, and deletes analysis data within 24 hours; you can ask us to turn this off for your account. We do not sell your data and we do not use your document content for advertising.

What the product learns from your documents, your pricing history and your bid patterns, belongs to you. It is never pooled across customers unless you explicitly opt in to help improve the product (off by default), and you can take your documents with you and close your account at any time. In an organization workspace, that permission can also be granted by an organization admin on the company’s behalf (for example in a written pilot agreement); your personal opt-out in account settings always overrides it.

Infrastructure and subprocessors

The hosted service runs on a small, well-scoped set of providers. Each processes data only for the purpose listed below.

Monitoring and activity logging

Before every document analysis call, we record an entry in a keyed activity log: the timestamp, the user, the document, the operation, the number of bytes sent, and a keyed HMAC-SHA-256 hash of the prompt. The hash lets the log be verified without storing the full prompt text, and the keyed signature makes entries tamper-resistant.

On the hosted cloud we use one privacy-preserving product analytics provider (PostHog) to see which features are used and where errors happen. It is metadata only: no document content, no filenames, no client or vendor names, no ad tracking, no session recording, and no cookies.

When an unexpected server error occurs on the hosted cloud, a scrubbed error report can go to a server-side error tracker (Sentry) so we can fix the failure: text values truncated, request bodies, cookies, headers, and query strings removed, file paths outside our application directory redacted, and an opaque account identifier at most, never an email address. Nothing runs in your browser, and error events are retained for 90 days.

Compliance roadmap

• SOC 2 Type II: in progress.
• Independent penetration test: scheduled.

We do not display badges or certifications we have not yet earned.

Reliability

Data is protected by encrypted backups with a defined recovery process. A public status page is planned.

Responsible disclosure

If you believe you have found a security issue, please report it to security@flowmanual.com. We will acknowledge your report and keep you updated as we investigate. Our contact details are also published at /.well-known/security.txt.

Request documentation

A security overview and our data processing terms are available on request. Email security@flowmanual.com and tell us what your review process needs.

Hosting

FlowManual runs as a hosted cloud service at flowmanual.com. Your files are encrypted at rest with keys we manage, your workspace is isolated from every other customer’s, and you can download your documents anytime, request a full export, or delete your account at any time.