This page is written for the person who has to sign off on new software. It says what we do, what we don't have yet, and who to email. Nothing on it requires an NDA to read.
| Control | Status | Detail |
|---|---|---|
| Encryption in transit | Yes | HTTPS with HSTS on the web app, the API, the MCP server and device sync. Plain HTTP is redirected. Webhooks are only ever delivered to HTTPS endpoints. |
| Password storage | Yes | Salted, iterated hashes (ASP.NET Core Identity). Minimum 8 characters with mixed case, a digit and a symbol. |
| API key storage | Yes | Shown once, stored as a salted PBKDF2-SHA512 hash. Only a short prefix is kept in the clear so you can tell keys apart in the list. |
| Multi-tenant isolation | Yes | Every record carries its organization; every query, API call and MCP tool is filtered by the caller's organization on the server. There is no "all organizations" mode outside our own system administration. |
| Roles and permissions | Yes | Organization Admin, Manager and User roles, plus more than 30 fine-grained permissions (view/manage per area). API keys carry a subset of their creator's permissions and can never be granted more. |
| Audit history | Yes | Jobs keep a timestamped history of every status change, assignment, note and edit with who did it; stock movements and payments record who made them. API and MCP requests are logged per key with method, path, status and timing. |
| Webhook integrity | Yes | HMAC-SHA256 signature on every delivery; private, loopback and link-local destinations refused; redirects never followed. |
| Rate limiting | Yes | Per key and per organization on the API and MCP server. |
| Device authorization | Yes | Desktop and Android installs are registered devices with their own tokens; an administrator can revoke a device and it stops syncing. |
| Payment card data | Never stored | Card entry and storage happen at Stripe. Flex holds your plan, seat count and invoice history only. |
| Data export | Yes | Everything is reachable through the API; invoices export to CSV for QuickBooks; a full account export is available on request. |
| Backups | Yes | A database snapshot is taken before every production deployment and before any bulk data operation, and kept alongside the previous release for rollback. Schedule and retention details on request. |
| Two-factor authentication | Not yet | On the roadmap. Today: strong password policy, 30-day hard session expiry, device registration. |
| Single sign-on (SAML / OIDC) | Not yet | Planned. Ask if it's a requirement for you — it moves up the list. |
| SOC 2 / ISO 27001 | No | We are a small company and have not undergone a third-party audit. We would rather say so than imply one. We will complete a security questionnaire for any prospective customer. |
An organization id is attached at sign-in, at key creation and at device registration, and the server applies it to every read and write. A bug in a page cannot widen the scope; the scope is decided before the page runs.
An API key or an AI agent gets the permissions you tick and nothing else. A key cannot be granted more than its creator holds. Give a reporting tool read-only keys; give a scheduling bot ManageJobs and nothing about invoices.
Outbound webhooks are signed so the receiver can prove they came from us. Destinations are validated when you subscribe and again at send time, so Flex can't be used to poke at someone's internal network.
Database credentials, signing keys and third-party tokens live in server configuration with restricted file permissions, outside the repository, and are rotated when staff or contractors change.
The Windows desktop keeps a local copy so work continues without internet. That copy is tied to a registered device and a signed-in user; permissions are enforced locally the same way they are on the server, and a revoked device stops syncing.
Your business data is not used to train AI models, build marketing profiles or benchmark you against other customers. The MCP server exists so your chosen agent can act for you; we don't run one over your account. Details on the AI page.
Lock-in is not a retention strategy we're interested in.
| Provider | Purpose | What they see |
|---|---|---|
| Stripe | Billing | Billing contact, company name, plan; card details go straight to Stripe. |
| Cloudflare | DNS and inbound email routing | DNS queries; mail sent to our @flexonthejob.com addresses. |
| Google Fonts / reCAPTCHA | Marketing site only | Visitor IP on flexonthejob.com; never loaded inside the app. |
Hosting is on servers we operate ourselves, not on a shared multi-tenant SaaS platform. Region and provider details are available to customers on request. We'll tell you before adding a sub-processor that would see your business data.
Email security@flexonthejob.com. A human reads it. We acknowledge within two business days, keep you updated while we fix it, and credit you if you'd like.
Machine-readable: /.well-known/security.txt
We'll complete your vendor security questionnaire, sign a data processing agreement, and walk your IT person through the architecture on a call.
Only if you give them the role for it. A User sees the jobs they're on and the stock they touch; a Manager sees the whole operation; an Organization Admin also manages users, keys and billing. Each role's permissions can be adjusted per organization.
Deactivate the user in Settings. Their signed-in sessions end within five minutes, their devices stop syncing, and any API keys they created are listed so you can revoke them. Their name stays on the history they wrote.
Not today. Keys are limited by permission, rate and revocation. IP allow-lists are on the list; tell us if it's a requirement.
We run our own security reviews on every release that touches authentication, the API or sync, and fix findings before shipping. We have not commissioned an external penetration test yet; when we do, the summary will be here.
There hasn't been a security incident affecting customer data. If there ever is, affected organizations are notified by email within 72 hours of confirmation, and a summary is posted on this page.
Ask the people who built it. We'd rather answer now than surprise you later.
on the job