Security

Flowproof holds access to your production systems and deletes records in them. That takes a lot of trust, so here is how we try to earn it, in plain terms.

Reference

The one rule

Cleanup acts only on the exact list of addresses a run created. Never a pattern, never a domain, never a wildcard. Everything else on this page exists to make that rule hold even if something else goes wrong: the list can only be written by Flowproof’s own services, the database re-checks every address on it, and a system that reports acting outside it is switched off. Cleanup has the details.

Your credentials

Database connection strings and Stripe keys are encrypted (AES-256-GCM) the moment they arrive, with a key that only the cleanup service has. The dashboard can’t read them, they never appear in logs, and they’re scrubbed from error messages. Removing a connection deletes them.
WordPress and webhook connections keep their credentials on your side. Flowproof holds only a signing secret (encrypted too) and signs every request with it; requests older than five minutes are refused.
Your API keys are stored only as a fingerprint, so we can’t show one again or leak it. Revoke a key on the Setup page and it stops working.
Connected apps (claude.ai, Claude Desktop, ChatGPT) sign in with your Flowproof account and can do only what your API key can. Their access tokens last an hour, and every token is stored only as a fingerprint. Revoke an app on the Setup page and it stops working right away.
Test checkout tokens are a separate kind of credential that can only answer “is this a live test user?” for one project.
Test hooks have their own signing secret (encrypted, shown once). Your app acts on a call only if it is signed, names one of your project’s test addresses, and Flowproof confirms that exact call, once. See Testing scheduled emails.
Privileged keys never reach your browser. The dashboard works with your own sign-in, and the database only shows you your own data. Keys that can do more live only on Flowproof’s servers.

What we store

Your account email and plan.
The emails your app sends to test addresses, and what your agent recorded in each run. Email bodies (which can hold live login links) are deleted first; reports are kept longer. How long depends on your plan: retention.
Cleanup receipts, permanently. They can’t be changed or deleted, even by us, so they stay trustworthy as a record of what was deleted.
The addresses each run created, permanently, so a test address is never issued to anyone else.
One anonymous result per finished run, for research. It isn’t linked to you; see Anonymous research below.

Project names are never reissued either: nobody can take over an old project’s name and receive mail meant for its test accounts.

Anonymous research

When a run finishes, we keep one anonymous result: the grade, how long each email took to arrive, which checks passed or failed, whether SPF, DKIM and DMARC passed, and which email service sent it (Postmark or Amazon SES, for example; never your domain). We pool these across every app to publish research like “The State of Signup Emails”, and we only publish a number when at least 20 results are behind it.

The result never includes an email address, a domain, a subject line, any wording, a link, a code, or anything that ties it to your account, project or run. The date is kept only to the week.

Email Flow Grader runs are always included.
Your own runs are included unless you turn it off, under Your data on the Billing page. Turning it off stops future runs from being included.
Past results are already anonymous and can’t be traced back to you, which also means we can’t pick them out to delete.
Flow Watch runs are never included.

Known limits

We’d rather you hear these from us:

If you connect Supabase with a connection string, Flowproof holds it, encrypted. To avoid that, use the Edge Function: it runs the cleanup inside your own project, and Flowproof never holds your database password.
A live test address is effectively a secret while its run is open. Someone who learns one can send mail to it, and, if your app offers test checkout before email is confirmed, could use it until the run ends.
Stripe cleanup can miss a customer whose email your app re-capitalised. It can’t delete the wrong one.
Flow Watch doesn’t yet ask you to prove you own the site a watch points at. For now, the requirement is armed cleanup on the project, a paid plan, and a cap of 6 runs an hour per site.