Easyflow holds the requests, approvals and documents your company runs on, so this page explains plainly how we protect them. All traffic uses HTTPS, every workspace is isolated in the data layer, permissions are checked on the server for every action, and every request keeps a tamper-evident history. We do not hold security certifications today, and we would rather describe what the product actually does than borrow a badge. Where Easyflow is hosted and how backups work are described in the Hosting and backups section at the end of this page.
Accounts and passwords
- Passwords are hashed with bcrypt and never stored in plain text.
- Nobody sets another person's password. Members are invited by email and choose their own password through a one-time link.
- After you sign in, the app keeps your login token in your browser's local storage, and removes it when you sign out.
Workspace isolation
Each customer's data lives in its own workspace. Isolation is enforced in the data layer: every query is scoped to the workspace of the person making the request, so isolation does not depend on each feature remembering to filter by workspace.
Permissions and hidden fields
- Permissions are checked on the server for every action. The app hides buttons you cannot use, but that is a convenience; the server makes the decision.
- A process can hide a field from some of its steps. Hidden fields are stripped on the server from the pages, PDFs and emails of the people who should not see them, so the value never reaches their browser or inbox.
Audit log and tamper-evident history
- Every change is recorded in an audit log: who did what, and when.
- Each request keeps a timeline of its steps, field changes and comments. Each entry is chained to the previous one with a hash, so any later change to the history is detectable.
Document verification
Generated PDFs carry a verification code and a SHA-256 fingerprint. Anyone who has the code can check a document's authenticity at /verify. That page shows only the document's title, issuer, date and fingerprint, not its content.
Email links
Approving or filling in a step from an email is convenient, so these links are built carefully:
- each link is signed and scoped to a single purpose;
- it is bound to the specific step, and stops working as soon as the step moves on;
- it never acts on a simple click. Opening it shows a confirmation page first, so email security scanners that open links automatically cannot approve anything.
Public pages and rate limits
Public request forms, guest steps, tracking pages and document verification work without an account. These public endpoints are rate limited to slow down abuse and guessing.
When a workspace is inactive, it is blocked from the API, realtime updates, scheduled processes and every public link.
Signatures, photos and location
- A signature stores the typed name, the acceptance of the text being signed, the time, the user and email address, and a salted hash of the IP address. The IP address itself is not stored.
- Photo fields can stamp the date and time on the image, and the device's GPS location only when the process requires it and the browser's location permission is granted.
Webhooks
Customers can send process events to their own systems with webhooks. Each webhook request is signed, so the receiving system can confirm it came from Easyflow. Webhooks cannot be pointed at private network addresses, which prevents them from being used to reach internal systems.
File uploads
Files are uploaded directly from your browser to S3-compatible object storage, using short-lived signed upload URLs. File contents do not pass through our application servers.
AI features
The AI assistant is optional and is used only when a manager asks it to draft or edit a process or a document layout. When that happens, the current process draft and the messages in the conversation are sent to OpenAI's API to generate the answer. Changes are applied through defined editing operations rather than by saving the model's raw output, and the previous version of the process is kept so it can be restored.
Staff access
Within Easyflow, administrative access across workspaces is limited to our system administrators.
Reporting a vulnerability
If you believe you have found a security issue in Easyflow, write to security@easy.wf. Please include:
- a description of the issue and its impact;
- the steps or a proof of concept to reproduce it;
- the affected URLs or features.
While you investigate, please do not access or change data that is not yours, do not degrade the service for others, and give us a reasonable time to fix the issue before disclosing it publicly. We appreciate reports made in good faith and will keep you informed as we work on them.
Hosting and backups
The application and its database run on Oracle Cloud Infrastructure in the United States. Uploaded files are stored in DigitalOcean Spaces, also in the United States.
The database is backed up every hour, and each backup is kept for 14 days.