Security

Where your data is

• The app runs on Vercel and the database, files and sign-in on Supabase, both in the United States (Oregon).
• Every connection is encrypted (HTTPS). Data is encrypted at rest by the database host.
• Production runs on a paid database plan with daily backups and point-in-time restore.

Each company's records are separate

• Every record belongs to one company, and the database itself (row-level security on every table) decides who can see or change it, not just the screens.
• Automated tests prove, on every change to the product, that one company can't see or change another's records.
• Permissions are checked on the server for every action; screens only hide what a person can't use.

Signing in

• Passwords are handled by the sign-in service and stored hashed; we never see them.
• Two-step sign-in with an authenticator app. A company's owner can require it for everyone who signs in with an email.
• Repeated wrong passwords, or wrong PINs for the same initials, lock them for 15 minutes; locks are recorded in the audit trail.
• Office users can be signed out after a number of idle minutes (the company chooses); shared floor stations sign people out by themselves.
• Floor workers sign with initials and a PIN. PINs are stored hashed (bcrypt) where even the app can't read them.

Signatures and the audit trail

• Each electronic signature records who signed, what the signature means (performed, verified, reviewed, approved) and when, and is checked on the server.
• Signed records and the audit trail can't be changed or deleted: the database refuses it, whoever asks. A correction is a new signed entry.
• Every change to a record is in the audit trail: who, when, the old value and the new one.
• BatchFlow is designed to support 21 CFR Part 11. Your company validates it for its own use (Settings > Validation has the protocols).

Our access

• Our support staff see a company's setup and recent changes only while its owner allows it (1 to 30 days), never its records directly.
• Every look support takes is listed where the owner sees it.

Your data stays yours

• The owner can download all of the company's records at any time, in one file.
• Records are never deleted because a payment failed: the company becomes read-only and everything can still be seen and exported.
• Card payments are handled by Stripe; card numbers never reach our servers.

Certifications

We don't hold SOC 2 or ISO 27001 certification yet. We'll say so here when that changes.

Reporting a security problem

If you think you've found a security problem, write to support@usebatchflow.com with what you found and how to see it. Please don't look at other companies' data or disrupt the service while checking. We'll reply within two working days.