1. Our security posture
Flowarden handles money signals — recurring charges, virtual cards, household budgets. That obligates us to defend it like a bank vault, not a marketing list.
- Encryption in transit: TLS 1.3 with HSTS preload. No mixed content, no plaintext fallbacks.
- Encryption at rest: AES-256-GCM on every database, backup, and object store. Keys rotated every 90 days via AWS KMS.
- Read-only bank links: Plaid tokens are scoped read-only. We never have authority to move your money.
- Zero-trust internal network: All employee access is brokered through short-lived SSO tokens with hardware keys (FIDO2). No standing database access.
- Audit logging: Every privileged action — admin reads, role changes, data exports — is written to an append-only log retained for 12 months.
2. Compliance & certifications
- SOC 2 Type II — observation window in progress, report expected Q3 2026.
- GDPR & UK GDPR — DPA available on request via privacy@flowarden.com.
- CCPA / CPRA — California residents can exercise rights from Settings → Privacy.
- PCI DSS scope reduction — we never touch real PAN data. Paddle (our Merchant of Record) handles all card payments.
3. Responsible disclosure
If you believe you've found a security vulnerability in Flowarden, we want to hear about it. Email security@flowarden.com with:
- A clear description of the issue and its impact
- Steps to reproduce, including any URLs, payloads, or accounts used
- Your contact information so we can reply and (if eligible) pay a bounty
We acknowledge new reports within 1 business day and aim to triage within 3 business days.
Optional: encrypt your message with our PGP key (fingerprint published in /.well-known/security.txt).
4. Bug bounty
We pay bounties for the first reporter of qualifying issues. Awards are at our discretion and depend on impact, novelty, and report quality.
| Severity | Examples | Reward |
|---|---|---|
| Critical | RCE, auth bypass, mass-PII exposure | Up to $5,000 |
| High | Stored XSS on app.*, IDOR on financial data | Up to $1,500 |
| Medium | CSRF on state-changing endpoints, SSRF | Up to $500 |
| Low | Reflected XSS with limited reach, missing headers | Up to $150 |
5. In scope
flowarden.comand all subdomains- Flowarden web application (
app.flowarden.com) - Flowarden public API (
api.flowarden.com) - Browser extension (Chrome, Firefox, Edge, Safari)
- iOS and Android mobile apps
6. Out of scope
- Denial-of-service, volumetric, or stress-testing attacks
- Social engineering of Flowarden staff, contractors, or vendors
- Physical attacks on offices or data centres
- Issues in third-party services (Plaid, Paddle, AWS) — report to those vendors
- Missing best-practice headers without a demonstrable exploit
- Self-XSS, clickjacking on non-sensitive pages, or rate-limit bypasses without impact
- Reports from automated scanners with no manual validation
7. Safe-harbor
We will not pursue legal action against researchers who, in good faith:
- Make a good-faith effort to avoid privacy violations and service disruption
- Use only test accounts, not real user data
- Do not exfiltrate, modify, or destroy data beyond what's needed to demonstrate the bug
- Give us reasonable time to remediate before any public disclosure
- Do not violate any other applicable laws
If a third party initiates legal action against you for activity conducted under this policy, we will make it known that your actions were authorised.
8. Hall of fame
With your permission, we credit confirmed reporters at flowarden.com/security-disclosure#hof. Email us if you'd like your handle, name, and link added.
9. Contact
security@flowarden.com · Response within 1 business day.