Security at Flowen

1. Our Security Philosophy

Flowen is built on EU infrastructure with security as a first-class concern, not an afterthought. We operate under the principle that customer data should never leave the European Union, that strong cryptography is the default, and that transparency builds trust.

This page describes the technical and operational measures we have in place. We also list areas where we are actively investing to improve, because honest disclosure is part of how we think about security.

2. Hosting & Infrastructure

• DDoS protection: OVH's anti-DDoS infrastructure with capacity to mitigate attacks up to 1.3 Tbps, always-on, included at no extra cost
• Geographic redundancy: Continuous database replication between France and Germany
• EU data sovereignty: All production data remains within the EU/EEA at all times
• No US-based providers processing production data — no CLOUD Act exposure
• Network isolation: Geo-blocking on administrative endpoints, restricted access to internal services

3. Encryption

4. Authentication & Access Control

• Email verification is required before account access is granted
• JWT-based authentication with separate access and refresh tokens
• Role-based access control at the team and resource level
• Password reset via signed, time-limited tokens delivered by email
• OAuth integrations (Microsoft Graph, LinkedIn, Facebook) where applicable, delegating authentication to the provider
• Soft-delete on critical records to allow recovery from accidental data loss

5. Infrastructure Hardening

• SSH key-only authentication on all servers — password authentication is disabled
• fail2ban active for automatic blocking of brute-force attempts
• Geo-blocking on administrative endpoints
• Self-hosted secret management via Vaultwarden (open-source, EU-hosted) — no third-party password managers in our internal workflow
• Regular system updates applied to production servers
• Zero-downtime deploys via PM2 reload — security patches can be applied without service interruption
• Limited deployment surface — only the application owner has production server access

6. Backup & Disaster Recovery

• Continuous replication from OVH (France) to Hetzner (Germany) via rsync and PostgreSQL streaming replication
• Daily off-site backup to Storegate (Swedish backup provider) via rclone
• Retention policy: 30-day backup history with point-in-time recovery options
• Soft-delete retention of 90 days on user-facing data, allowing recovery from accidental deletion
• Geographically distributed — backups exist in multiple EU countries

7. Monitoring & Error Tracking

Flowen runs an internal error logging system that captures application errors with context (module, action, user) for review and remediation. We do not use third-party error tracking services that would transmit potentially sensitive data outside the EU.

Analytics are self-hosted using Umami at analytics.flowen.eu, which is GDPR-compliant by design and does not use cookies or tracking pixels.

8. Compliance & Standards

9. Incident Response & Disclosure

If a security incident occurs that affects customer data or service availability, we follow a structured process:

1. Containment — immediate action to limit impact
2. Investigation — root cause analysis with technical detail
3. Communication — affected customers notified within 24 hours
4. Regulatory notification — Swedish Data Protection Authority (IMY) informed within 72 hours when GDPR-relevant
5. Post-mortem — published incident report describing what happened, what we did, and what we changed
6. Hardening — security improvements deployed and documented

No security incidents affecting customer data have occurred in Flowen's production operation.

10. Vulnerability Disclosure

We welcome reports from the security research community. If you believe you have found a security vulnerability in Flowen, please contact us responsibly.

11. Security Roadmap

We believe transparency about planned improvements is more honest than implying our current state is complete. The following are in active development:

12. Contact