Security

Merchants run their operations on Enflow, so protecting their data — and their customers’ data — is core to the product. This page describes the measures we take.

All traffic to and within the Services is encrypted in transit with TLS, and data is encrypted at rest by our cloud infrastructure providers. Credentials for connected services — such as WhatsApp Business and sales channel API keys — are stored encrypted and are never exposed in the browser.

Enflow is multi-tenant: every workspace’s data is isolated with tenant-level access rules enforced at the database layer, so one merchant’s data is never visible to another.

Access within a workspace is governed by role-based permissions that the account owner controls. Sensitive actions — including actions taken by AI features — are recorded in audit logs. Internal access to production data is restricted to authorised personnel and limited to what support and operations require.

AI-assisted features operate inside guardrails: they use approved tools with per-action audit logging and budget limits, and merchant data sent to AI providers is governed by contracts that prohibit training on it.

The Services run on established cloud providers that maintain their own certified physical and network security programmes. We keep dependencies updated and apply security patches promptly.

Backups are taken regularly and stored encrypted. Data retention and deletion are described in our Privacy Policy.

If you believe you have found a security vulnerability in Enflow, please email hello@enflow.in with the details. We will acknowledge your report promptly, investigate, and keep you informed. We ask that you avoid accessing other users’ data and give us reasonable time to fix the issue before public disclosure; we will not pursue action against good-faith research conducted under these guidelines.

Security questions? Email hello@enflow.in.