Security and trust

This page lists what the product does to protect data and where it runs. It is not a certification of the product.

What the product does

Signing in

  • Passwords are stored only as salted hashes.
  • Passwords need at least 15 characters and are checked against a list of common passwords.
  • Five failed sign-ins lock an account for 15 minutes.
  • Administrator accounts must have a second sign-in step: an authenticator app, or the identity provider's own second step under single sign-on. An administrator may remember a device for the period the organization sets, from 1 to 90 days, and 30 days unless it is changed.
  • An organization can limit sign-in to a list of network ranges. This is off by default.
  • A session ends after 30 minutes without activity, and no session lasts longer than 12 hours.
  • People can see where they are signed in and end any session themselves.
  • Sign-in attempts are rate limited.
  • Access follows roles, and the most sensitive actions are limited to the highest role.

Your data

  • The database never holds readable customer or technician text. What a technician types during a case is stored encrypted with a key that exists only in that technician's session. The encrypted text is deleted when the technician interrupts or abandons the case, starts another case, signs out, or the session ends. For a completed case, it remains available on the summary until the technician starts another case or the session ends.
  • Browsers are told to use HTTPS only.
  • Authenticator secrets are encrypted by the application before they are stored, and backup codes are stored as hashes.
  • Case records become eligible for deletion 180 days after they end and are deleted by a weekly job; deactivated accounts are anonymized after 90 days, except the last remaining superadministrator. A legal hold stops deletion of a held record.
  • An audit trail records sign-ins, security changes, and administrator actions. Administrators can filter it and export it.
  • Email from the service never includes what a technician typed or the customer fields. A ticket email a technician sends carries that case's checks and its code. Workflow and step titles written by administrators do appear in alerts. Invitation links work once and expire after 48 hours.

How it is built and checked

  • The service sends a content security policy and other browser security headers.
  • Every change runs an automated scan for known vulnerable dependencies.
  • We design to the WCAG 2.2 AA target, with keyboard operation, labeled controls and visible focus.

Security self assessment

We checked the product ourselves against OWASP ASVS 5.0.0 Level 2 on November 1, 2026.

78 requirements met, 113 open with a tracked fix, 62 do not apply to this product.

This is our own documented self assessment, not an independent audit or a certification.

Customers can ask for the full row by row assessment through Contact.

Hosting

This installation runs on Replit.

Replit states on its security page that it holds SOC 2 Type II certification.

We read that page on October 22, 2026. That page does not publish the report's date, audit period, scope, or auditor, so we cannot state them here. The provider makes the report available through its trust center. We have not reviewed the report ourselves. Its trust center is at trust.replit.com.

The product itself has not completed a SOC 2 audit.

A hosting provider's report, whatever it covers, is about the provider's own systems. It is not an audit of this application.

The product is not intended for protected health information, and we offer no Business Associate Agreement.

What we do not claim

  • No SOC 2 audit of the product.
  • No ISO 27001 for the product.
  • Not for use with protected health information.
  • No Business Associate Agreement.

How to ask

To ask about any of this, email info@supportflowguide.com or use the Contact page.