# Flow Security

Flow runs governed agents against your systems. This page states what the platform does to protect credentials, data, and access. It lists only controls that are implemented; it does not claim certifications or contractual terms that are not in place.

## Credentials — three tiers

- **Connections (OAuth, Composio, native).** Tokens are stored encrypted and used only by the runtime. The model never receives a raw token; it sees the outcome of a tool call. Tokens are registered with the log redactor, so they cannot appear in session logs.
- **Logins (browser sign-in).** Passwords are decrypted only inside the runtime. With credential-by-reference, the agent signs in with `browser fill` and a `secret_ref` to the saved login; the value is filled by the runtime and never enters the model's reasoning context. Fills are allowed only on the login's own domain. One-time codes are generated server-side.
- **Secrets (key-value).** Stored encrypted, attached per agent revision, and visible in the UI by key name only.

Saved logins and secrets are scoped as personal or team, and an agent can use only the items attached to its revision.

## Encryption and data handling

- AES-256-GCM encryption at rest for credentials, login data, and paused run state (conversation state is stored encrypted).
- TLS 1.2+ in transit.
- Session logs pass through a PII and secret redactor; redaction survives pauses and resumes.
- Model traffic goes through Flow's gateway to Anthropic APIs; customer content is not used to train models.

## Access control

- Team roles: owner, admin, manager, builder, member, process-mapping. Logins, secrets, connections, API keys, and the audit log are role-gated.
- API keys are hashed; the plaintext is shown once on creation.
- Signed webhooks (`X-Flow-Signature`) and `Idempotency-Key` for safe retries.
- Invite-only sign-in with one-time email codes; sessions can be revoked server-side.

## Runs and guardrails

- Blocked domains are enforced in the browser engine regardless of the agent's instructions.
- Consequential actions require approval in Shadow Mode; human-in-the-loop requests pause the run until a reviewer answers.
- Preflight checks stop a run before it starts when a required connection or login is missing; repeated skips auto-pause the schedule or trigger.
- Tool calls are deduplicated across trigger double-fires; retries never replay a send or write.
- Take-over of a live browser session is captured in the session log.

## Audit log

Four event families are recorded per team: actor (sign-ins, invitations, role changes, connections, logins and secrets by name, API keys), builder (agent created, AOP edited, published, schedules, triggers, duplicated, deleted), run (started, completed, failed, stopped, human requests and decisions), admin (team changes, member removal). Owners and admins can view and export it as CSV.

## Not currently offered

- SOC 2 or ISO 27001 reports.
- Customer-managed keys (KMS) and zero-data-retention contracts with model providers.
- Single sign-on (SSO/SAML) and SIEM push; audit data is available in-product and via export.
- Per-run VM isolation for browser sessions (sessions are isolated per run on shared infrastructure).

Contact the workspace owner for security questionnaires.