Security you can check, not just claims.
FeedbackFlow is early, so this page lists only what is true today and names what is still on the roadmap. Nothing here is aspirational.
Credentials encrypted at rest
Every integration secret you enter (Slack, Intercom, Zendesk, Jira, and Linear) is encrypted with AES-256-GCM before it is stored, each with its own initialization vector and authentication tag.
Row-level security in the database
Your data lives in Postgres on Supabase with row-level security on every tenant table. Access is scoped to your account, so one customer can never read another customer’s projects, feedback, or integrations.
Authentication by Supabase
Sign-in runs on Supabase Auth with email and password or OAuth through GitHub and Google. Sessions are validated server-side on every protected request.
API keys verified by hash
Widget requests are verified against a SHA-256 hash of your project’s API key. You can regenerate a key at any time, which immediately invalidates the old one.
Deleting your data
When you delete a project, everything attached to it is deleted with it: its feedback, AI-generated topics and groups, customer records, and stored integration credentials. The removal cascades in the database, so nothing is left orphaned.
To close your account entirely and have your remaining data removed, email us at info@usefeedbackflow.com and we will take care of it. What we collect and why is described on our privacy page.
Not available yet
These are planned for larger teams but are not implemented today. We list them here so you know what is and is not in place.
- SSO and SAML
- Audit log
- Role-based access control
- SOC 2 attestation
Found something, or have a security question? Email info@usefeedbackflow.com.