Your payroll, your site records, your photos. Here is exactly what happens to them.
Moving a firm's pay and every site record into someone else's software is an act of trust. This page is the mechanism, not the reassurance: how your data travels, where it sits, how it is walled off from every other company on Flow, and the four copies of it that exist by breakfast every day. It also says what we don't have yet.
Eight things that are always on
None of these are settings you have to find. They are how the product is built and they apply to every company from the £29 plan up.
Encrypted on the way
Everything between the phone or browser and Flow travels over TLS, and browsers are told to refuse plain HTTP for two years (HSTS). There is no unencrypted path in.
Encrypted where it sits
The database (Neon, on AWS) and the file store (Cloudflare R2) both encrypt every byte at rest with AES-256. Secrets Flow holds on your behalf, such as two-factor seeds and accounting-integration tokens, are encrypted a second time with our own key before they reach the database.
Your rows are yours
Every record carries your company's ID, and the database enforces row-level security on it. A query that forgets to filter by company still cannot return another company's data, because Postgres refuses at the row. This is enforced below the application, not by it.
Passwords and sign-in
Passwords are hashed with bcrypt and never stored. Two-factor authentication (authenticator app with recovery codes) is available to everyone and can be made compulsory for your whole firm. Sessions expire after 30 days and are invalidated the moment a password changes.
Files are never public
Photos, payslips, drawings and certificates are served through short-lived signed links: 15 minutes to download, 5 to upload. A link copied out of a message stops working before the tea has gone cold.
Everything is logged
Every change to money, people or documents is written to an append-only audit log that cannot be edited or deleted, even by us. Directors can read their firm's log in Settings.
Cards never touch us
Subscription payments go straight to Stripe. Flow never sees or stores a card number.
Roles, not passwords, decide access
Forty modules, each grantable per role or per person. A worker sees their own hours and payslips. A site manager sees their sites. The accountant sees payroll and nothing about The Crew. You decide, and it is enforced on every request.
Backed up four ways. Restore-tested every week.
Two of the copies live with the database provider and recover from mistakes: a bad import, a deleted project, a bug. Two live somewhere else entirely and recover from losing the provider. And every Sunday, a machine restores the off-site copy into a fresh database and counts what came back, because a backup nobody has restored is a hope, not a backup.
How much could you lose
Seconds
within the seven-day rewind window. Twenty-four hours at the absolute worst, from the off-site vault.
How long to get it back
Under an hour
from a rewind or snapshot. Under four hours to rebuild from the vault onto new infrastructure. We time this in a drill every quarter.
Who is watching
A machine, then a person
Every backup job must check in on time. A missed check-in, a small dump, or an empty database pages the founder's phone.
What happens if…
- A worker loses their phone.
- Their session is tied to the device and can be revoked from Settings in one click. Nothing is stored on the handset except what the app cached to work offline, which is protected by the phone's own lock.
- Someone deletes the wrong project, or a bad import wipes a week.
- We rewind the database to any second in the last seven days, or to any nightly snapshot in the last thirty. We restore the affected rows, not the whole company, so nothing else moves.
- Our database provider has a bad day, or we lose access to the account.
- Every night an encrypted copy of the whole database and every file leaves for a vault on a different provider, under different credentials. It has been restored from that vault into a fresh database every Sunday. That is the copy we would rebuild from.
- We get hacked.
- We treat it as a breach: revoke every session and token, rotate the encryption key, restore from the last clean copy, and notify you and the ICO within 72 hours, as UK GDPR requires. Backups are encrypted with a key that does not live on the servers, so a compromised server does not hand over the archive.
- You leave Flow.
- Your data is yours. Export timesheets, reports, payroll, CIS statements and documents from inside the app at any time, as PDF, CSV, Excel or a zip. Ask and we will provide a full export of your company's data, then delete it on request.
Who else touches your data
Flow is built on a small number of infrastructure providers, each under a data-processing agreement. Nothing you put in Flow is used to train anyone's AI models.
| Provider | What for | Sees |
|---|---|---|
| Neon | Database | Everything, encrypted at rest |
| Cloudflare | Files, off-site backup vault | Files; the vault only sees ciphertext |
| Vercel | Runs the application | Data in flight while serving a request |
| Stripe | Subscription billing | Your card, your company name. Never your site data |
| Resend | Email delivery | The emails Flow sends on your behalf |
| Sentry | Error reporting | Stack traces, scrubbed of personal data |
| AI providers | Tender pricing from your spec and drawings; receipt and certificate reading; RAMS drafts | Only the documents you give it, per request, with training opted out |
Frequently asked questions
- Where is my data stored?
- In a PostgreSQL database run by Neon on Amazon Web Services, and a Cloudflare R2 object store for files. Both encrypt data at rest with AES-256. The application runs on Vercel. Sub-processors are listed on this page and in the privacy policy.
- How is my company's data kept separate from other companies'?
- Every row is tagged with your company and the database enforces row-level security on that tag. Even a bug in the application cannot return another company's rows, because Postgres itself refuses. Access within your company is then controlled per role and per person across forty modules.
- How is Flow backed up?
- Four ways, automatically, every night: continuous point-in-time recovery for the last seven days, a frozen daily snapshot kept for thirty days, and an encrypted off-site copy of the database and all files on a different provider, kept for 35 days plus 13 monthly copies. Every Sunday the off-site copy is restored into a fresh database and checked, so we know it works before we need it.
Questions a page can't answer?
Ask the founder directly. He runs his own firm's payroll on this same database, so he has the same stake in the answer that you do.
See also: why we built Flow.