ServflowThis page says what we do today. It does not describe certifications we do not hold or infrastructure we do not run.
Data in transit
Traffic between you and ServFlow is encrypted with TLS, terminated at Cloudflare. Traffic between Cloudflare and our servers, and between services on our own network, is not separately encrypted.
Data at rest
The credentials you give us are encrypted at rest with AES-256-GCM: secrets, integration configurations, LLM provider configurations, and OAuth tokens. Other content, including agent configurations and workspace files, is stored unencrypted in our database and on our server's disks.
Where your data runs
Everything runs on a single provider, Hostinger, in the United States. We do not operate in multiple regions and we do not currently offer a redundancy or availability commitment.
Agent isolation
When an agent runs a shell command, it runs in a container created for that request and removed afterwards, with its own working directory and none of the host's environment. Agent configurations cannot read the environment of the service they run in. Workspace file access is confined to the workspace's own directory.
Secret values that an agent resolves are masked wherever text leaves the run: in traces, logs, errors, and results.
Billing information
Cards are entered on pages hosted by Stripe and never reach our servers. Stripe is PCI DSS compliant. We hold only a customer identifier and the current plan.
Access
Sign-in is through Auth0. Your team's API token is stored in our database and can be regenerated from the dashboard at any time. Staff access to production is limited to people who operate the service.
Reporting a vulnerability
If you believe you have found a security problem in ServFlow, write to us at Servflow, Inc., 1111b South Governors Ave Ste 29848, Dover, DE 19904, United States. We ask that you give us reasonable time to fix a problem before disclosing it.