Security
CrossFlow is built for teams handling sensitive commercial intelligence. We take a defence-in-depth approach to security across infrastructure, data handling, and application design.
Encryption in transit and at rest
All data is encrypted in transit using TLS 1.2+. Data at rest is encrypted using AES-256. Credentials are hashed using bcrypt and never stored in plaintext.
Authentication and access control
Multi-factor authentication is available on all accounts. Role-based access controls ensure users only see data their account is licensed for. Session tokens are rotated regularly.
Infrastructure
CrossFlow is hosted on Vercel (edge functions) and Supabase (PostgreSQL). Both providers maintain SOC 2 Type II compliance. Data is stored in EU-based data centres by default.
Row-level security
Every database query is scoped to the authenticated organisation using Supabase Row Level Security (RLS). No tenant can access another tenant's data.
Backups and recovery
Database backups run continuously with point-in-time recovery available. We test restore procedures regularly. Our target RTO is under 4 hours.
Incident response
We monitor for anomalies using Sentry and infrastructure alerting. In the event of a breach, we will notify affected customers within 72 hours in line with GDPR requirements.
Sub-processors
| Vendor | Purpose | Region |
|---|---|---|
| Supabase | Database and authentication | EU |
| Vercel | Hosting and edge infrastructure | Global CDN |
| Stripe | Payment processing | US / EU |
| Anthropic | AI analysis and scoring | US |
| Resend | Transactional email | US |
| PostHog | Product analytics | EU |
| Sentry | Error monitoring | US |
| Upstash | Rate limiting (Redis) | EU |
Responsible disclosure
If you discover a security vulnerability in CrossFlow, please report it responsibly by emailing security@crossflow.pro. Please do not disclose vulnerabilities publicly until we have had a reasonable opportunity to investigate and remediate. We aim to acknowledge reports within 48 hours and resolve confirmed vulnerabilities within 30 days.
Security questions or requests? security@crossflow.pro