Skip to main content
FLASHFENDER
Security

How we protect your dealer data.

Plain English, not marketing fluff. Here is what we encrypt, how we isolate tenants, who we share data with, and what to do if you find a hole.

Last updated: July 15, 2026

Encryption at rest and in transit

All customer data is encrypted in transit with TLS 1.3 (minimum TLS 1.2) using modern cipher suites. At rest, data is encrypted with AES-256 on the underlying storage layer, with per-row keys for the most sensitive fields (driver's license numbers, signatures, voice call recordings).
  • TLS 1.3 in transit (minimum TLS 1.2), HSTS enabled on flashfender.com
  • AES-256 at rest on the database and object storage layer
  • Per-row keys on driver's license, signature, and call recording fields
  • Database and storage credentials rotated every 90 days

Tenant isolation via Postgres row-level security

Every tenant in FlashFender is a row in a Postgres table, and every query path is gated by row-level security policies on the database itself — not just in application code. A user authenticated to tenant A cannot read, write, or even reference a row in tenant B; the database returns zero rows.
  • Postgres RLS policies on every tenant-scoped table
  • Application queries go through a server-side client that injects the tenant claim
  • Cross-tenant reads are impossible without an explicit service-role key (never used from the browser)
  • Tenant claim is signed and verified on every request by the proxy

Per-store role-based access control

A user can be scoped to one store, several stores, or all stores in a dealer group. Roles are Owner, General Manager, Sales Manager, Salesperson, BDC, IT, and a custom-role slot for dealers that need something specific. Permissions are enforced both in the API layer and the database (RLS).
  • Roles: Owner / GM / Sales Manager / Sales / BDC / IT
  • Per-store scoping — a GM at Store A cannot see Store B's data
  • Custom roles available on Pro and AI Suite plans
  • User provisioning through email invite or SCIM (Pro and above)

Audit logging

Every state-changing API call writes an audit row with the actor, the action, the resource, the before/after diff (for PII-bearing fields), and the request IP. Audit logs are append-only and surfaced in the dashboard for Owner and GM roles. Logs are retained for 24 months.
  • Every write writes an audit row (actor, action, resource, IP)
  • Append-only; no in-app delete path for audit rows
  • Visible to Owner and GM in the dashboard
  • 24-month retention; exportable to CSV on request

Incident response

We treat any confirmed unauthorized access to customer data as a Severity 1 incident. Our on-call rotation pages within 5 minutes, customer impact is triaged within 1 hour, and affected customers are notified within 72 hours (or sooner, per contractual obligations).
  • 24/7 on-call rotation; pages in under 5 minutes
  • Customer impact triaged within 1 hour of confirmed Sev-1
  • Customer notification within 72 hours of confirmed data exposure
  • Postmortem published for any Sev-1 or Sev-2 (with redactions where appropriate)

Responsible disclosure

Found a security issue? Please email security@flashfender.com with a description and a reproducer. We'll acknowledge within one business day and aim to triage within five business days. We don't pursue legal action against good-faith research, and we run a paid bounty program for confirmed high-impact findings.
  • Acknowledge within 1 business day
  • Triage within 5 business days
  • Paid bounty for high-impact confirmed findings
  • Safe-harbor for good-faith research

Service status and uptime

The status page is at flashfender.com/status and shows live status for API, dashboard, database, storage, AI voice, OCR, VIN decoder, Carfax, email, and billing. Subscribe to email updates from the status page.
  • Live status for 10 services on the public status page
  • Email subscriptions for incident and resolution notifications
  • 90-day rolling uptime history on the public status page
  • Postmortems linked from any non-operational status entry

Sub-processors

The third parties that process customer data on our behalf. We notify customers 30 days before adding a new sub-processor.

VendorPurposeRegion
SupabasePostgres database, authentication, file storageUS-East (default); EU available on Pro+
TwilioProgrammable voice for the AI voice botUS / EU (BYOC number)
OpenAIVoice bot language model, call summarizationUS
Cloudflare WorkersHosting and edge network for flashfender.comGlobal edge; primary US-East
ResendTransactional email (invites, confirmations, status)US
CarfaxVehicle history reports (when configured)US

Report a security issue

Email security@flashfender.com with a description and a reproducer. We'll acknowledge within one business day.

Need a security questionnaire answered?

We have a CAIQ, a SIG Lite, and an answer-to-anything call with our CTO. Tell us what you need.

Contact securityRead the changelog