How we protect your data
Your data security is our top priority. We implement industry-standard security measures to protect your business and your customers' information. Our application and database are hosted in Germany (EU) on Hetzner infrastructure; a few sub-processors, such as the AI assistant and payment processing, operate outside the EEA and are listed in our sub-processor register.
Data protection
Encryption at Rest
AES-256-GCMSession notes, client outcome records, integration credentials, payment tokens and two-factor secrets are encrypted with AES-256-GCM at the application layer before they reach the database. Other client data — contact details, custom fields, the free-text note on a client record and intake-form answers — is not field-encrypted; it is protected by TLS, access controls and per-account isolation.
Encryption in Transit
TLSData transmitted between your browser and our servers is encrypted in transit with TLS: version 1.3 where your browser supports it, 1.2 at minimum, with modern cipher suites.
Sign-in & Passwords
OAuth 2.0 · Hashed passwordsYou can sign in with Google, Facebook or Apple through OAuth 2.0, or with an email address and password. A password is never stored as you typed it — only a salted one-way hash of it, which cannot be turned back into the password.
Session security
RevocableSessions expire automatically, and you can sign out any device, or every device, from Settings → Security & Privacy.
Infrastructure Security
Hetzner ISO 27001Hosted on Hetzner in Germany. Hetzner data centres are ISO 27001 certified and provide enterprise-level physical security and DDoS mitigation at the network edge.
Database Backups
BackupsYour database is backed up automatically every night, and again before each release. Backups are encrypted with AES-256 and rotate out within 90 days. Each week an automated drill restores a backup into a test database, so recovery is tested rather than assumed.
Security practices
Error Monitoring
Application errors are tracked, and repeated failed sign-ins and unusual account activity are monitored automatically so we can respond early.
Regular Updates
Dependencies and systems are regularly updated to address security vulnerabilities and maintain best practices.
Access Controls
Per-user data isolation and role-based access control (RBAC) ensure team members only access data necessary for their role.
Internal Code Review
Code changes go through internal security review, and the backend code is checked with automated static analysis and dependency vulnerability scanning.
Compliance & data protection
GDPR-aligned
- Data processing agreements
- Right to access & deletion
- Data portability
- Breach notification
Card payments (iyzico)
- Secure payment processing via iyzico
- No full card numbers or security codes stored in our database
- Tokenised transactions
- 3D Secure card verification
Incident response
Our commitment
In the unlikely event of a security incident affecting your data, we commit to:
- Notifying affected users within 72 hours of discovery
- Providing clear information about what data was affected
- Taking immediate steps to contain and remediate the incident
- Conducting thorough post-incident reviews
Report a vulnerability
We appreciate responsible disclosure. If you discover a security vulnerability, please report it to us at contact@clientflow.center
We will acknowledge your report and work with you to understand and address the issue promptly.