Clear boundaries around your records.
Security comes from controls that are enforced and tested. This page describes implemented protections and their limits; it is not a certification or a promise that vulnerabilities cannot exist.
Identity separation
Customer and platform staff sessions have different cookies and authenticated encryption bindings. Platform admin and developer identities are denied customer sessions and customer requests. Staff use a separate console with explicitly granted roles and mandatory authenticator verification. A business owner does not receive platform administration.
Business permissions
Server-side membership and scoped permissions govern organization records, sensitive fields and exports. Permission and revision checks run with writes to prevent stale or unauthorized changes. Financial values use integer minor units, with atomic allocations, immutable correction history and retry keys.
Account protection
Confirmed email is required. Account settings support authenticator QR enrollment, provider-verified MFA, one-time recovery codes and session revocation. Enrolled customer accounts require MFA; sensitive account and staff actions require fresh verification. Recovery credentials cannot be reused as a routine login.
Operational limits
Application snapshots are encrypted and omit authentication session and recovery-code rows. A snapshot is not proof of a successful production restore. No independent security certification, complete external penetration-test pass or cross-country compliance certification is claimed. Email acceptance and manual payment records remain distinct from delivery and settlement verification.
Report a concern
Use Contact DeniFlow with a short description, affected route and a safe reproduction using your own accounts. Do not include credentials or retrieve other businesses’ records. We have not published a paid bug-bounty program or a safe-harbor agreement; arrange testing scope before intrusive testing.
Need a clear answer?
Use the contact form for product and privacy questions, or open a support case for your account.
Contact DeniFlowAccount support