What we do — and what we don't claim.

Data separation

Every business has its own workspace. Row-level security is switched on for every database table, so a signed-in user can only read or change rows that belong to a workspace they are a member of. We test this with automated checks that try to read and write another business's data and must fail.

Roles

• Owner: everything, including roles and data requests.
• Admin: settings, knowledge approval, automations.
• Staff: inbox, leads, draft knowledge.
• Viewer: read-only.

Plan changes and healthcare mode can only be changed by the FLOWTIVA platform team, checked inside the database, not just hidden in the screen.

Keys and secrets

AI keys and server keys live only in server-side secret storage. They are never sent to browsers, put in the website code or committed to source control.

The public chat

The website chat is protected by per-visitor and per-network rate limits, message size limits, an optional list of allowed websites and monthly plan limits. Each visitor gets a private token; only its fingerprint is stored.

AI safety

The assistant is instructed to answer only from information you approve, ignore instructions hidden in customer messages, and say when it does not know. Replies are checked again after the AI writes them. In healthcare mode it never gives medical advice.

Audit and data rights

Role changes, plan activations, deletions and workspace creation are recorded in an audit log. Owners can request a data export or deletion from Settings; we complete these requests manually and confirm by WhatsApp or email.

Limits

No system is perfectly secure, and we do not claim compliance with any law or certification. AI can make mistakes. Do not use FLOWTIVA to collect detailed health, financial or identity documents. To report a security issue, message us on WhatsApp.