Skip to Content
SecurityOverview

Security Overview

Built on AWS

FlowState is built entirely on AWS in the EU (Frankfurt, eu-central-1 region). All client data is stored and processed in the EU. AWS provides the underlying infrastructure security, physical access controls, and network isolation.

Encryption

All data is encrypted at rest and in transit.

  • In transit: all traffic uses TLS 1.2 or higher. This applies to the web application, the API, email, and all outbound calls to HubSpot, Stripe, and AWS Partner Central.
  • At rest: all data stored in databases, object storage, and secrets management is encrypted using AES-256 with keys managed in AWS Key Management Service (KMS).

Tenant isolation

Your data is never shared with other clients. This isolation is enforced at multiple independent layers — application code, IAM session tags, a per-tenant KMS key, and secret resource policies — so that a failure in any one layer cannot expose another tenant’s data.

A dedicated encryption key is created for every tenant and is used to encrypt that tenant’s audit-log archive. Other data stores (including your database records and stored secrets) are encrypted at rest using an account-level AWS-managed KMS key shared across tenants, rather than a key unique to each tenant. In all cases, access to another tenant’s data is blocked by IAM policy and session-tag based access control, independent of which key encrypts it.

Additional controls:

  • WAF: FlowState uses AWS WAF in front of the API, running managed rule groups (covering common web exploits and known-bad-input patterns, plus an IP reputation list) along with rate-based rate-limiting to block abusive traffic.
  • MFA enforcement: in production, the owner and admin roles have their permissions restricted until the user enrolls in multi-factor authentication.
  • Token lifetimes: Cognito access and ID tokens are valid for 1 hour; the refresh token is valid for 30 days, refreshed transparently by the app in the background.

Compliance

FlowState processes data in accordance with GDPR. All data at rest is stored in the EU. FlowState can provide a Data Processing Agreement (DPA) for clients who require one under GDPR Article 28. See the GDPR page and subprocessors list for details.

Contact

For security questions or to report a vulnerability, contact security@copebit.ch.

Custom rolesTiers