Skip to Content
SecurityOverview

Security overview

Where your data lives

FlowState runs on AWS. Your data is stored in Frankfurt, Germany (eu-central-1).

Two parts of FlowState process data outside Frankfurt:

  • AWS Partner Central events. AWS Partner Central publishes its events only in the US East (N. Virginia) region (us-east-1), so FlowState’s APN inbound handler runs there. It keeps no records in that region and stores the result in Frankfurt. Events wait in an encrypted queue in us-east-1 only until they are processed; an event that fails processing stays there for up to 14 days. The handler’s operational logs are also kept in us-east-1.
  • AI analysis. FlowState uses Anthropic’s Claude models through Amazon Bedrock. AI requests are processed only in European AWS regions: Frankfurt, Stockholm, Milan, Spain, Ireland or Paris. Bedrock does not store the request, and the result is stored in Frankfurt.

Encryption

  • In transit: all traffic uses TLS 1.2 or higher: the web app, the API, the MCP server, email, and FlowState’s calls to HubSpot, Slack, Stripe and AWS.
  • At rest: all stored data is encrypted with AES-256 keys held in AWS Key Management Service (KMS).
    • Your tenant’s own key: every tenant gets its own encryption key. It encrypts your HubSpot and Slack credentials and your audit-log archive.
    • FlowState’s key: your other records are encrypted with a key that FlowState manages and uses for all tenants.

Tenant isolation

Your data is never shared with other clients. Several independent controls keep each tenant separate, so a failure in one of them does not expose another tenant’s data:

  • Every request is tied to one tenant by your sign-in. No request can name another tenant.
  • The code that serves a request can reach only that tenant’s data and credentials.
  • Your stored credentials can be decrypted only for your tenant.
  • A blocked attempt to cross a tenant boundary raises an alert to FlowState’s operations team.

Access control

  • Roles: each member has one role in a tenant: owner, admin, member or viewer. See Roles.
  • Multi-factor authentication: owners and admins get their permissions only after they set up an authenticator app, or when they sign in with a Google Workspace account.
  • Sign-in lifetime: an access token is valid for 1 hour, and the app renews it in the background. After 30 days you sign in again.
  • AI assistants (MCP): only owners, admins and members can use the MCP server; a viewer is refused before any tool runs. See MCP authentication.
  • API keys: a key works for one tenant, only on the operations that accept keys, and only with the permissions chosen when it was created. See API Reference.
  • Audit log: changes in your tenant are recorded. Owners and admins see them under Settings → Notifications → Audit.

Protection against abuse

A web application firewall protects the sign-in service, the web app and the MCP server against common web attacks and abusive traffic. The API limits the rate of requests.

Compliance

FlowState processes data in line with the GDPR. FlowState can provide a Data Processing Agreement (DPA) under GDPR Article 28. See GDPR and Sub-processors.

Contact

For security questions or to report a vulnerability, email security@copebit.ch.

SecurityArchitecture