Trust & Security
A factual snapshot of current controls.
How Flopinio controls access to your workspace, records approvals, and handles account and billing information.
Flopinio is not currently claiming SOC 2 or ISO certifications. This page represents live technical controls.
Shipped Security Layers
Transport Security
The production configuration is designed to enforce HTTPS/TLS with HSTS, secure cookies, and signed session data for authenticated flows.
Encryption At Rest
Sensitive encrypted attributes use Rails Active Record Encryption with environment-managed keys, for those fields. This is not a claim that every field is encrypted at rest.
Identity & Access
Local password auth, OAuth 2.0 (Google/GitHub), MFA support, and recent-auth confirmation protect sensitive account and organization changes.
Resource Scoping
Flopinio scopes workspace access to your organization. Application permission checks determine which records each role can read or change.
AI and MCP approvals
AI reviews and drafts can run without a separate approval. Applying changes follows the permissions and approval rules for that workflow. MCP writes require manual review by default; a token explicitly permitted to self-approve may approve its own eligible writes for the same user and organization. Both paths keep a recorded approval and execution history.
Audit Logging
Security events, AI and MCP actions, and billing operations are recorded for administrative review and incident investigation.
Request Safeguards
Content Security Policy, per-request nonces, rate limiting, trusted-proxy handling, and signed webhook verification reduce common abuse paths.
Billing Integrity
When production billing is configured, Paddle is designed to handle raw card processing while Flopinio stores subscription and invoice state rather than card numbers.
Secure Integrations
OAuth callbacks, Slack, Paddle, Telegram, and mail sync paths use signed secrets, secure comparison, and TLS/STARTTLS where those protocols apply.
Control Details
How access and activity are protected.
These are current technical controls, not third-party certification claims. They describe how Flopinio protects customer data, authenticated sessions, integrations, AI actions, and billing-adjacent operations today.
Encryption and transport
- The production configuration is designed to enforce HTTPS/TLS with HSTS, secure cookies, and signed session data for authenticated flows.
- Encrypted attributes use Rails Active Record Encryption with primary, deterministic, and key-derivation salt material supplied through credentials or environment variables.
- SMTP delivery is configured with STARTTLS for mail transport.
Application safeguards
- Content Security Policy restricts default, script, style, image, object, frame, and connection sources, with per-request nonces for script execution.
- Pundit policies default sensitive reads and writes to deny unless a permitted role and organization context are present.
- Security-sensitive flows use recent-auth confirmation, MFA enrollment/reset paths, signed cookies, and rate limiting where abuse risk is higher.
Operational evidence
- Security events, billing changes, integration activity, and AI and MCP approval actions are recorded for administrator review.
- Webhook and integration secrets are checked with constant-time secure comparison where signatures or shared secrets are used.
- When production billing is configured, Paddle is designed to handle raw card processing while Flopinio stores subscription and invoice state rather than card numbers.
Program Boundaries
-
No Certification Overclaims
We do not claim SOC 2, ISO, or HIPAA compliance until third-party audits are completed and documented here.
-
Roadmap Exclusion
Future security packaging work (e.g., SIEM exports, SSO/SAML) is roadmap material and is not part of today's claim surface.
Resources
For security inquiries or responsible disclosure, please contact our security team.
[email protected]