Your records, kept to your company.

The security note

Where your data lives

FileFlo's database and file storage run on Supabase, in its us-west-1 region in Northern California. Uploaded files sit in private storage, and none of it is public: the app opens a file through a signed link that expires after an hour or less. The database is backed up once a day, and the last seven daily backups are kept, in the same region.

Encryption

Supabase encrypts all stored customer data with AES-256. Data in transit travels over TLS: the app and this site send plain HTTP to HTTPS and tell browsers to use HTTPS only.

Your records, kept apart

A signed-in user sees only their own company's records and files. The database enforces it: row-level security limits every read of a record to the user's own company, and every read of a file to the company's own folder in storage.

Who at FileFlo can open your documents

FileFlo's operators can open any customer's document in FileFlo's operator console, to deliver work such as the Audit-Ready Setup or to recover a document that failed to process. Each view needs a written reason, and the database records which operator looked at which document and when, in a log no one can edit. The file opens through a link that expires after five minutes. Operators can also reach the database and file storage directly through Supabase's own admin tools, to run and repair the system. FileFlo keeps no record of that access the way it does for the console.

People you share with

Anyone you send a sealed inspector link to sees the documents it holds until it expires or you revoke it, and every access to the link is logged.

Outside services that see your data

• Supabase stores FileFlo's database and files, and runs its server functions.
• OpenAI reads uploaded documents to classify them and pull out names and dates.
• Google Gemini, through Lovable's AI gateway reads a photo of a document when OpenAI cannot.
• Anthropic reads a document when OpenAI cannot, and runs the in-app assistant, which sees document details such as type, name and dates.
• Resend sends FileFlo's email.
• Twilio sends FileFlo's text messages.
• Stripe takes card payments on its own checkout page, so FileFlo never sees a card number.
• PostHog counts page views and clicks in the app. Session recording is off.
• Google Drive, OneDrive and Dropbox only when you connect your own account to bring files in.

FileFlo does not sell your data.

Export

In Settings, Export everything downloads every document you have sent and a file of the records they are filed against, as one ZIP. Above 2 GB or 2,000 files, FileFlo sends it as a drive on request.

Deletion

Delete a document in the app and its file is deleted with it. To close your account, write to support@getfileflo.com. If no compliance events have been recorded from your records, FileFlo erases the account, its records and its files. Once they have, FileFlo closes the account instead: sign-ins are turned off, processing stops, and the dated log of those events stays, because it is built so no one can edit or delete it. Backups roll off after seven days. While an account is open, FileFlo keeps its records.

What FileFlo does not hold

FileFlo does not hold a SOC 2 report or any other security certification.