Security
We built FlowCensus for the day it gets attacked.
An inventory of weaknesses is a target document. So the question we designed for is not whether we are safe, but what an attacker would get.
The commitment
If FlowCensus is compromised, the attacker
- gets no credential that authenticates into any of your systems,
- gets no personal data of your customers,
- and does not get the content of your flows.
What is in our databases is encrypted per customer. A dump without access to our key service does not produce a usable target.
Never stored
Four things we never write anywhere.
Not to disk, not to logs, not to caches, queues or temporary files. Each one is covered by an automated test.
Raw workflow JSON
It exists in memory during the scan and is discarded.
Secret values
Not the value, not part of it, not a hash, not its first characters.
pinnedData content
Test data left inside a flow is detected, classified and counted. Nothing of its content is kept.
Your customers' personal data
We never process data about your customers or end users.
What we keep
Only what a finding needs, and a reason for each field.
| Category | Examples | Why |
|---|---|---|
| Finding identity | Fingerprint, rule ID, resource type | Track the same finding across scans |
| Structure | Flow, node and credential names (never values) | Locate the finding and write the fix guide |
| Classification | Severity, business-impact axes and their evidence | The ruler |
| Ownership | Who built the flow, and how we know | Route the fix to the right person |
| Events | Event type, time, role of who resolved it | Measure remediation |
| Redacted excerpt | Bearer *** | Debug a false positive |
| Accounts | Names and work emails of your users | Run the product |
We do process personal data of your employees: the name and work email of whoever built each flow and of who uses FlowCensus. That is unavoidable, and it is the full extent of it.
How it is protected
One database per customer
Data is segregated by structure, not by a filter in a query. Reaching one customer gives no path to another.
Field-level encryption
Flow, node and credential names, locators and excerpts are encrypted with a data key unique to your company. A dump shows fingerprints and rule IDs — a statistical picture, not a map.
Your API key in an envelope
Encrypted with a per-customer key wrapped by AWS KMS. Decrypting requires a cloud identity that does not leak with a database dump. Never logged, never returned by the API.
Read-only by design
On connection we check that your n8n key cannot write and warn you if it can. We never write, and never request execution payloads.
Hardened access
Multi-factor authentication on every account. No SSH into servers: administrative sessions go through a recorded channel.
Edge and infrastructure
AWS in us-east-2 (Ohio), behind CloudFront with a web application firewall and rate limiting. All infrastructure is code, reviewed and applied by pipeline.
Retention
Four clocks, enforced by scheduled jobs.
| What | Kept for |
|---|---|
| Raw workflow JSON | Zero — memory only |
| Redacted excerpts | 90 days |
| Finding state | Contract term + 30 days |
| Event log | Contract term + 12 months (you can shorten it) |
When you leave, we drop your database, delete your data key and revoke your API key. Encrypted backups expire within 14 days, after which nothing of yours remains. You receive a dated deletion certificate listing what was deleted and when.
Compliance
Processor under LGPD and GDPR, with the paperwork to match.
Your company is the controller: you decide what to scan and why. We act as processor (operador, under Brazil's LGPD) under a data processing agreement that follows GDPR Article 28.
- Incidents: we notify affected customers without undue delay, with what we know, and follow the shortest legal deadline that applies (72 hours under GDPR).
- International transfers rely on standard contractual clauses.
- We hold no certifications yet. When we do, they will be listed here — not before.
Found a vulnerability?
Write to us. We reply within two business days and do not pursue good-faith research.