Security
Your payroll and invoices, kept safe
What Flowbit does to protect your workspace today, in plain words.
Sign-in and two-factor
- Passwords are stored only as bcrypt hashes; sign-in and code attempts are rate limited.
- Two-factor sign-in with an authenticator app, with remembered devices; owners can require it for owners and admins.
- Sessions can be seen and signed out from Settings → Security.
- Flowbit staff use a separate Console on its own host, with two-factor sign-in required.
Encryption
- Traffic to Flowbit is HTTPS only, and the database connection uses TLS.
- Secrets you give Flowbit (your Razorpay keys, GSP login, Google and Slack tokens, webhook secrets, two-factor secrets) are encrypted with AES-256-GCM before they are stored, and never shown again in full.
- Files sit in a private storage bucket with public access blocked; downloads check who is asking (only your logo is public, for your emails).
Roles and permissions
- Eight built-in roles (Owner, Admin, HR admin, HR executive, Finance, Manager, Sales, Member) from 76 permissions, plus custom roles.
- Permissions are checked on the server for every change, not only hidden in the interface.
- Each workspace’s data is kept apart: every query is scoped to the signed-in workspace.
- Sensitive details such as bank accounts, PAN and salaries need their own permission.
Audit log
- Sensitive actions (payroll steps, role and permission changes, exports, sign-in settings, integrations) are written to an audit log with who, what and when.
- People with audit access can read and export it in Settings → Audit log.
DPDP and your data
- For your clients’ and employees’ data, Flowbit acts as your data processor under a data processing agreement (see Data processing terms).
- Export or erase one person’s data on request, from Settings → Privacy.
- Message and processing logs are kept 13 months, then deleted (DPDP asks for at least a year), and a breach process tells you straight away so you can meet your own deadlines.
- Flowbit staff see your workspace only when an owner grants support access, read-only or import-only, for a limited time.
Export and deletion
- An owner can export the whole workspace as a ZIP at any time.
- Deleting a workspace can be undone for 30 days (write to support); after that its data is removed.
Hosting and backups
- Workspace data is stored in India: the app runs on Vercel and the database on MongoDB Atlas, both in Mumbai (AWS ap-south-1). Some providers process data outside India when their feature is used, such as email (Resend), AI drafting (Anthropic) and the meeting notetaker (Recall.ai).
- Backups come from the database provider; ask support for the current schedule and retention. Your own copy is always one ZIP export away.
Found a security issue? Write to support with the details; we reply within one working day. support@useflowbit.com · Data processing terms · Privacy policy
Everything in flow. Nothing in the way
Start with a workspace that is yours alone.
Teams of up to 5 people use Flowbit free for 6 months; bigger teams get a 15-day trial of everything. No card needed. Nothing to install, made for Indian teams.