Security
Last updated: May 2026
Security is fundamental to everything we build at Flitch Solutions Pty Ltd ABN 57 682 821 512 of 191 St Georges Terrace, Perth, WA 6000, Australia ("Flitch"). This page describes our security practices, infrastructure, and how we protect your data.
1. Overview
Here's a quick summary of our security practices:
- Encrypted: All data encrypted in transit and at rest.
- Secure Infrastructure: Built on AWS with industry best practices.
- Privacy by Design: No training on your data by AI providers.
- Access Controls: Role-based permissions and secure authentication.
2. Infrastructure Security
Our infrastructure is built on trusted cloud providers with robust security practices:
Amazon Web Services (AWS)
Primary hosting infrastructure. AWS maintains SOC 2, ISO 27001, and other compliance certifications.
Neon (PostgreSQL)
Database hosting with automated backups, encryption at rest, and secure network isolation.
Vercel
Application hosting with automatic HTTPS, DDoS protection, and edge network security.
Stripe
PCI DSS Level 1 certified payment processing. We never store card numbers.
3. Data Encryption
Encryption in Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS for all connections and use HSTS to prevent downgrade attacks.
Encryption at Rest
All data stored in our databases and file storage is encrypted at rest using AES-256 encryption. Database backups are also encrypted.
Credential Security
We do not store usernames or passwords. All authentication is handled through OAuth providers (Google and Microsoft), meaning your credentials remain securely managed by your identity provider.
4. AI Provider Security
When you generate dashboards, your prompts are processed by AI providers. Here's how we ensure your data remains secure:
Zero Data Retention for Training: We use API access to Anthropic and Google, which means your data is not used for model training. This is contractually guaranteed by our API agreements.
Anthropic (Claude)
- No data retention for training via API
- SOC 2 Type II certified
- Enterprise security controls
Google (Gemini)
- No data retention for training via API
- Enterprise-grade security
- ISO 27001, SOC 2 certified
5. Authentication & Access Control
Authentication
We use OAuth-only authentication, meaning we never handle or store your passwords:
- Google OAuth: Sign in securely with your Google account.
- Microsoft OAuth: Sign in securely with your Microsoft account.
Session Security
- Secure, httpOnly session cookies
- Automatic session expiration
- Session management through account settings
Team Access Controls
Team accounts support role-based access control with admin and member roles. Admins can manage team members and control access to dashboards.
6. Application Security
We follow security best practices in our application development:
Security Headers
- Content Security Policy (CSP)
- X-Frame-Options (clickjacking protection)
- X-Content-Type-Options
- Strict-Transport-Security (HSTS)
- X-XSS-Protection
Security Practices
- Input validation and sanitisation
- Parameterised database queries
- CSRF token protection
- Rate limiting on sensitive endpoints
- Regular dependency updates
7. Data Isolation
We implement strict data isolation to ensure your data remains private:
- Multi-tenant architecture: All data is scoped to your account or team.
- Database-level isolation: Queries are always filtered by account/team ID.
- API authorisation: Every API request validates access permissions.
- File storage isolation: Uploaded files are stored in account-specific paths.
8. Data Breach Response
In accordance with the Australian Notifiable Data Breaches (NDB) scheme, we maintain incident response procedures:
- Detection: We monitor for security incidents and anomalous activity.
- Assessment: We assess potential breaches within 30 days as required.
- Notification: If a breach is likely to cause serious harm, we notify affected individuals and the OAIC as soon as practicable.
- Remediation: We take immediate steps to contain and remediate any breach.
9. Vulnerability Reporting
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly:
Report vulnerabilities to:
[email protected]Please include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes (optional)
We commit to acknowledging reports within 48 hours and will keep you informed of our progress. We ask that you give us reasonable time to address vulnerabilities before any public disclosure.
10. Contact Us
If you have questions about our security practices or want to report a security concern, please contact us:
Email: [email protected]
Address: 191 St Georges Terrace, Perth, WA 6000, Australia
For information about how we handle your data, please read our Data Use & Privacy page and Privacy Policy.
Security FAQ
Common questions about how Flitch protects your data.