Falcon Flowmira
Security

Security you can
actually verify.

Flowmira is built BYOK-first, RLS-first, and audit-first. No shared inference gateway, no hidden middlemen, no telemetry on your canvas.

Yours, end to end
Your prompts, sources, and diagrams stay in your workspace. No shared inference gateway, no vendor telemetry on content.
BYOK vault, encrypted
Provider keys are stored encrypted at rest (AES-256-GCM) and only decrypted server-side for outbound calls.
Row-level security
Every user-owned table enforces RLS scoped to auth.uid(). Roles use a security-definer function; role checks can't be spoofed client-side.
Strong password policy
12-character minimum, HIBP leaked-password protection available. Passwords are never logged.
Minimal data collection
We collect what we need to run the product. No behavioral tracking of canvas content, ever.
Isolated per-workspace
Data is partitioned per workspace at the database layer, not just the app layer.
Full audit log
Role changes, admin actions, and privileged operations are recorded and exportable.
Protected ownership
The workspace owner role is unrevokable and enforced by database trigger.

Responsible disclosure

Found something concerning? We want to hear from you. Email security@falconveritas.com with reproduction steps. We acknowledge within 48 hours and coordinate a fix and public disclosure timeline.