This page says what Flow does with payment data, in plain English, and is careful not to claim more than it does.
Card numbers and bank account numbers are entered into a payment form served by Stripe and are sent from your customer's browser to Stripe. They do not pass through Flow's servers and Flow never stores them.
Payment amount, status, timestamps, the payer's name and email, a label such as "Visa ending 4242", your references and notes, and the processor's identifiers. Enough to show you a ledger, never enough to charge a card.
Stripe, which processes payments for Flow merchants, is certified as a PCI DSS Level 1 service provider. That certification is Stripe's, not Flow's.
Flow is designed so that card data never touches it, which keeps Flow's own PCI scope to the smallest category. Flow does not claim PCI Level 1 certification for itself.
Every Flow page, the merchant app, the customer pay page, the API and webhooks are served only over HTTPS (TLS). Plain HTTP is redirected.
Flow's database holds no card or bank numbers, so there is nothing of that kind to encrypt. Passwords are stored as salted hashes. API keys are stored hashed; the full key is shown once, when you create it.
Hashed with the PHP default algorithm (bcrypt or stronger), never stored in the clear. Minimum 10 characters.
Time-based one-time codes from an authenticator app. Turn it on in Settings. Flow also supports it for the Dark Water console.
Cookies are HttpOnly, Secure and SameSite. Signing in issues a fresh session.
Sign-in, sign-up and password reset are throttled per address. Too many tries and you wait.
Your customers never set a password. They get a one-time emailed link to see receipts and manage upcoming payments.
Every form carries an anti-forgery token tied to the session.
Notices from Stripe to Flow are verified the same way, with Stripe's signing secret, before Flow acts on them.
Moves the money. Verifies businesses as the law requires, holds balances, pays out to your bank, screens for fraud and handles the card-network side of disputes.
Everything you and your customers touch: sign-up, pay links, invoices, scheduling, receipts, the ledger, the API, and the records that tie each payout to its payments.
Keep your sign-in and API keys private, respond to disputes by their deadline, and only take payment for goods and services you provide.
Sign-ins, sign-ups, refunds, API key changes and account changes are written to an audit log with the actor, the action, the time and the address it came from.
Email [email protected] with "security" in the subject. We read every report and will reply. A dedicated disclosure address and policy are planned.
Create your account, connect your bank, send your first payment link. No monthly fee. No long-term contract. Clear transaction pricing.
by Dark Water