This page describes the security controls AIFlowBiz has enabled in the product today. It is maintained by the AIFlowBiz team and is not an independent certification. For specific compliance questions, contact us.

Authentication

Email + password with server-side hashing.
Google OAuth 2.0 sign-in.
Password reset via time-limited, single-use email links.
Session tokens are HTTP-only and refreshed automatically.

Authorization & access control

Every database table uses row-level security (RLS). A signed-in user can only read and write rows scoped to their own business.
Admin actions run through server-side edge functions using service credentials never exposed to the browser.
Roles are stored in a dedicated user_roles table checked by a security-definer function — never on the profile record.

Data storage & encryption

Data at rest is encrypted by the managed Postgres backend.
All traffic uses HTTPS / TLS end-to-end.
Business logos and avatars are stored in private buckets with signed URLs.

Payments

Payments are processed by Razorpay. Card and UPI details never touch AIFlowBiz servers.
Every order is verified server-side using HMAC-SHA256 signature verification.
Webhook events are verified against the raw request body and stored idempotently to prevent replay.

Secrets & keys

Service-role keys, Razorpay keys and third-party secrets are stored server-side only.
Client bundles never contain private credentials.
Edge functions return generic error messages to the browser and log details internally.

Infrastructure

Hosted on managed infrastructure with automatic backups and point-in-time recovery.
A strict Content Security Policy (CSP) and origin allowlist on all edge functions.
Rate-limited authentication and payment endpoints.

Responsible disclosure

Found a security issue? Please email us via the contact page before public disclosure. We respond within 3 business days and will credit reporters who ask to be named.

Read our data protection, privacy policy and cookie policy.

Security at AIFlowBiz