Security

1. Our commitment

Flostac is built on infrastructure where security is the default. All data in transit is encrypted with TLS 1.3, all data at rest is encrypted with AES-256, and access to production systems is gated by hardware-backed multi-factor authentication. We treat customer workspace data the way we would want our own treated.

2. How we protect your data

Encryption

• TLS 1.3 for every connection to the web app, API, and marketing site.
• AES-256 at rest across databases, file storage, and offline backups.
• Connected-platform tokens (Meta, Google, messaging providers) are encrypted with AES-256-GCM, with the key held outside the application database.

Access control

• Role-based access inside your organisation — you control who sees what.
• Hardware-backed MFA (security keys and platform authenticators) required for every Flostac staff member with production access.
• No standing access to customer workspaces. Engineers request time-bound access that is logged and reviewed.

Application security

• Continuous dependency updates, with production libraries routinely scanned for known CVEs.
• Authentication is delegated to industry-standard session handling with rate limiting and breach detection.
• Content Security Policy and standard browser-hardening headers applied to every response.
• Encrypted backups retained for 30 days, then rotated out.

Operational

• Administrative actions are logged and visible to your workspace admins.
• Incident-response runbook with named on-call coverage.
• Vendor due diligence on every sub-processor, with the current vendor list available on request.

3. Report a vulnerability

If you have found a security issue in Flostac, please email team.flostac@gmail.com with a subject line starting with SECURITY:. Include enough detail for us to reproduce — URL, payload, observed behaviour, and your assessment of impact.

We acknowledge reports within 5 business days and work with you on coordinated disclosure. We commit to not pursuing legal action against researchers who act in good faith, avoid privacy violations, and give us a reasonable window to fix before public disclosure.

We do not currently operate a paid bug-bounty programme. Genuine findings are credited, with your permission, in our release notes.

4. Out of scope

• Denial-of-service attacks, rate-limit exhaustion, or volumetric testing.
• Social engineering of Flostac staff or customers.
• Physical attacks against infrastructure we do not operate.
• Reports about hypothetical issues without a working proof of concept.

5. Compliance posture

Flostac is an early-stage product. We are not currently certified to SOC 2, ISO 27001, or HIPAA. The controls above are designed to be a credible starting point, and we will pursue formal certification as the business grows. If you have a specific compliance requirement, please reach out — we are happy to discuss scope and timelines.