Information Security Policy

FlashFlow is operated by a single individual. This policy describes the controls that are actually in place, and is deliberately specific about the limits of a one-person operation rather than implying a security programme that does not exist. Where a control is not implemented, it is listed under Known limitations.

Security concerns can be reported to security@flashflowai.com. We aim to acknowledge within 3 business days.

1. Scope

This policy covers the FlashFlow web application, its APIs, and the data stores behind them. It applies to all data processed on behalf of FlashFlow users, including data retrieved from connected third-party platforms such as TikTok Shop.

2. Data Classification

FlashFlow stores only what is required to deliver the product. Every field we hold falls into one of three classes, and the class determines how it is handled:

A new field is classified before it is stored, and anything that would be Restricted is only added when a feature cannot be delivered without it.

We do not collect end-consumer personal information, platform user profile data, direct messages, or audience data.

Data minimisation is enforced at the schema level: fields not needed to deliver a feature are removed rather than retained “in case”.

3. Access Control

Access to personal data is granted on the principle of least privilege: the minimum needed to perform a function, and nothing wider by default.

• Every table containing user data has PostgreSQL row-level security enabled, with policies scoping each row to its owning user. A user’s credentials cannot read another user’s rows, and this is enforced by the database rather than by application code.
• Tables with row-level security enabled and no policy deny all access by default. New tables are closed until explicitly opened.
• The privileged service key used by server-side jobs is held only in server-side environment variables and is never exposed to browsers or clients.
• No administrative interface in the product exposes one user’s commerce data to another user or to support staff.
• Administrative access to hosting and database consoles is limited to the sole operator and protected by multi-factor authentication.

Operational baseline

The controls applied to the workstation from which FlashFlow is administered:

• Full-disk encryption (FileVault) enabled.
• Automatic screen lock requiring a password on wake.
• Built-in endpoint malware protection (Apple XProtect and Gatekeeper) enabled, with automatic security updates applied.
• Multi-factor authentication on every administrative account — source control, hosting, and database.
• Unique, high-entropy credentials per service, held in a password manager rather than reused or written down.
• No shared logins. There is no second person to share one with, and no service account exists for a human to sign in as.

4. Encryption

• In transit — TLS for all traffic, including browser-to-application, application-to-database, and outbound third-party API calls.
• At rest — AES-256, provided by the managed database and storage platforms.

5. Network and Infrastructure

FlashFlow operates no self-managed servers or corporate network. The architecture is serverless, so segregation is architectural rather than perimeter-based:

• Compute runs as isolated, ephemeral serverless functions with no persistent local state and no inbound network surface other than HTTPS request handling.
• The database is a managed PostgreSQL instance reachable only over TLS with credentials, and is never addressed directly from client code.
• Tenant separation is enforced in the database by row-level security, so isolation does not depend on application code being correct.
• DDoS mitigation, WAF, and network traffic monitoring are provided by our hosting subprocessors.

6. Secure Development

• Every change passes an automated gate before deployment — full type-check, unit test suite, and a domain-accuracy evaluation. A failure blocks the deployment.
• Secrets are never committed to source control; they are held as environment variables in the hosting platform.
• Untrusted input is never permitted to determine a financial figure or trigger an outbound action. Model output is re-validated against deterministic rules before it can leave the system.
• Third-party webhooks are cryptographically verified before their payloads are processed — HMAC-SHA1 for Twilio, Ed25519 for Discord, and a shared service token for internal ingestion endpoints.

7. Vulnerability Management

• Automated database security advisors are reviewed and findings triaged by severity. As of the date above there are no error-level findings.
• Dependencies are updated on a rolling basis, with automated alerts for known vulnerable packages.
• Security issues can be reported to security@flashflowai.com.

8. Subprocessors

All storage and processing takes place in the United States.

Commerce data retrieved from connected platforms is never transmitted to any AI, analytics, advertising, or marketing provider. Language models are used only on content a user has explicitly forwarded to FlashFlow — they have no access to commerce data, and the providers named above are contracted not to train on it.

9. Retention and Deletion

• Data is retained while an account is active.
• A user may disconnect a connected platform at any time, which revokes the stored tokens.
• On account deletion, associated user data is removed. Requests to privacy@flashflowai.com are actioned within 30 days.
• We will assist a connected platform or its sellers in providing, correcting or deleting data on an end user’s request, on the same 30-day clock.
• At the end of a contractual relationship with a platform partner, all data collected under it is deleted, and deletion is confirmed in writing on request.

10. Incident Response

Roles. The Founder is the incident owner and holds every role in this process — detection, containment, assessment, notification and remediation. There is no rota and no escalation path, because there is no second person; saying otherwise would be a diagram, not a control.

Reporting channels. Anyone — a user, a platform partner, or an outside researcher — can report a suspected incident to security@flashflowai.com, acknowledged within 3 business days. Affected users are notified by email at the address on their account; affected platform partners are notified through the contact channel in their partner agreement.

In the event of a suspected breach, the operator will:

1. Contain — revoke affected credentials and, if necessary, take the affected surface offline.
2. Assess — determine what data was involved and whose.
3. Notify — inform affected users and any affected platform partner without undue delay, and in any case within 72 hours of confirming a breach involving personal data.
4. Remediate and document the root cause.

11. Known Limitations

Stated plainly, because a policy that overclaims is worse than one that is narrow and true:

• FlashFlow holds no third-party security certification (no SOC 2, ISO 27001, or equivalent) and has not undergone an independent penetration test.
• There is no security team; all responsibilities in this policy rest with the sole operator.
• Formal security awareness training and a documented internal audit programme are not applicable to a single-person organisation.
• A backlog of low-severity database advisories is tracked and being reduced; none are currently rated error-level.

12. Privacy Contact

FlashFlow has not appointed a statutory Data Protection Officer — a one-person organisation whose core activity is neither large-scale systematic monitoring nor the processing of special category data does not meet the threshold that requires one. A named privacy contact is designated instead, and answers everything a DPO would: privacy@flashflowai.com.

This policy is reviewed at least annually and whenever the architecture changes materially.