How Flash AI Connect protects your account and data

• Email-verified accounts

  Live

  Accounts use Supabase Auth. New accounts must confirm their email address before they can sign in.

• Bot protection

  Live

  Cloudflare Turnstile checks every sign-in, sign-up and password reset, and Supabase Auth verifies the check on its side.

• Failed sign-in pause

  Live

  After 5 wrong passwords within 15 minutes, the sign-in screen pauses further attempts for 15 minutes. Supabase Auth also applies its own rate limits.

• Two-factor for administrators

  Live

  Platform administrators must pass an authenticator-app (TOTP) check before the database grants any admin access.

• Two-factor for every account

  Rolling out

  Sign-in already asks for an authenticator-app code once two-factor is set up on an account. Self-service setup for customer accounts is rolling out.

• Each business kept separate

  Live

  Every business is its own organization in a Postgres database with row-level security, so database queries only return rows the signed-in member’s organization is allowed to see.

• Isolation is tested against the live database

  Live

  Automated checks sign in as two separate test businesses and try to read, change or spend each other’s data. They are expected to be refused, and the test accounts are deleted afterwards.

• Tamper-resistant credit ledger

  Live

  AI credits are kept in an append-only ledger that can’t be edited or deleted, even by our own server role.

• Audit log

  Live

  Key account events, such as creating an organization, starting a plan and granting credits, are written to an append-only audit log. Owners and admins can read their own organization’s entries.

• Encrypted connections

  Live

  The site and app are served over HTTPS by Netlify, with HSTS so browsers always use a secure connection.

• Security headers

  Live

  Pages send a Content Security Policy, nosniff and a strict referrer policy.

• Server-side AI proxy

  Live

  Every AI request goes from your browser to our server (/api/ai-proxy), which checks your session, membership and plan before calling the AI provider. Provider API keys stay on the server and are never sent to your browser.

• Credits shown on every answer

  Live

  Each AI answer shows the credits it used. Credits are reserved before a request and refunded if the provider call fails.

• Rate limits

  Live

  Per-user and per-organization rate limits protect against runaway or abusive use.

• Drafts for your approval

  Live

  The assistant is instructed to use only your organization’s data and to draft for approval, never sending, posting, paying or deleting anything itself.

• What we store about AI use

  Live

  Our database records usage (provider, model, credits, cost and status), not the text of your prompts or answers. The conversation is kept in your browser tab’s session.

• Stripe-hosted checkout

  Live

  Plans and credit packs are paid on Stripe’s secure checkout page. Card numbers are entered with Stripe, and we don’t store them.

• Verified payment events

  Live

  Payment updates from Stripe are accepted only with a valid Stripe signature, and each event is processed once.

• Manage billing yourself

  Live

  Owners can open Stripe’s billing portal from Billing to see invoices and cancel at the end of the billing period.

• Private preview password

  Live

  During the private preview, the app sits behind a site password. Only the public pages under /welcome/ are open. The password cookie is signed, HttpOnly and Secure, and repeated wrong passwords are slowed down.

• Data export and account deletion

  Rolling out

  Self-service export of your data and account deletion.

• Team roles and transparent reporting

  Rolling out

  Team features are permission-based: owners and admins see their organization, managers see their own locations, and each member can see exactly what is visible about them. Reporting can be switched off per organization, and nothing else is tracked: no keystrokes, screens, GPS, browsing or idle time.

Flash AI Connect runs on these providers. Each one maintains its own security program; their certifications belong to them, not to Flash AI Connect.

• SupabaseDatabase and sign-inSupabase security information (opens in a new tab)
• NetlifyHosting, HTTPS and server functionsNetlify security information (opens in a new tab)
• StripePaymentsStripe security information (opens in a new tab)
• CloudflareTurnstile bot protectionCloudflare security information (opens in a new tab)
• OpenAIAI model providerOpenAI security information (opens in a new tab)