Trust
How your evidence is stored and who can reach it
You are being asked to put photographs of other people's homes into a system. This page describes the controls that are actually in place — no certifications we do not hold, and no claims we cannot point at in the code.
Controls
What is implemented
Each item below is a control that exists in the product today, described specifically enough that you can ask us to demonstrate it.
Media is stored privately
Photos and documents live in a private storage bucket, not a public one. There is no URL that serves your media without authorization, and the bucket is created private rather than being made private after the fact.
Access is granted through short-lived signed URLs
When an authorized request needs a photo, the server mints a signed URL that expires in five minutes. That ceiling is enforced in the storage layer itself, so no calling code can request a longer-lived link.
Account isolation is enforced on the server
The account a request belongs to is derived from the authenticated session, never taken from anything the client sends. A request for a record in another account does not resolve — and returns a not-found rather than a forbidden, so the response cannot be used to confirm that a record exists.
Row-level security in the database
Public database access is denied at the row level in Postgres as a second layer beneath the application checks, rather than relying on application code being correct everywhere.
Share links expire and can be revoked
Links for residents and owners are issued as tokens, stored only as hashes rather than in plain text, carry an expiry, and can be revoked at any time. A resident inspection link also locks on submission: once submitted, photos in it cannot be added to, edited, or deleted through that link.
Encrypted in transit
All traffic runs over TLS. The web application additionally sends HSTS, a content security policy, frame-ancestor denial, and MIME-sniffing protection. Files waiting to upload on an iPhone are written with iOS file protection.
What we do not claim
The absent badges are deliberate
Security pages are usually a list of logos. Here is what is missing from this one, and why.
No certifications. ProFlow360 holds no independent third-party security attestation. If an external security certification is a procurement requirement for you, we are not a fit today, and it is better for both of us to establish that early.
No tamper-proofing claims. Records carry creation and update timestamps, attribution is preserved even if a user is later removed, and resident submissions lock on submit. That is meaningfully stronger than a shared drive. It is not the same thing as an immutable append-only ledger, and we will not describe it as one.
No regulatory assurances. Using ProFlow360 does not by itself satisfy any legal or regulatory obligation that applies to you. The product records and organizes what your team enters; obligations under your state's landlord-tenant law remain yours.
Disclosure
Reporting a vulnerability
If you believe you have found a security issue, email support@proflow360.com with enough detail to reproduce it.
Please give us a reasonable opportunity to investigate and remediate before disclosing publicly. We will confirm receipt and keep you updated on what we find. We do not currently run a paid bug bounty.
Questions
Security questions
- Do you hold any third-party security certifications?
- No. ProFlow360 holds no independent security attestation of any kind, and we are not going to imply otherwise. This page describes the controls that are actually implemented, so you can evaluate them directly rather than taking a badge at face value.
- Who can see the photos in my workspace?
- People in your account, according to their project role — admin, crew, or viewer — plus anyone holding a share link you created, for as long as that link remains valid and unrevoked. Access is scoped by the server from the authenticated session, not from anything a browser sends.
- How long do signed media URLs last?
- Five minutes, capped in the storage service so a caller cannot ask for longer. If someone forwards a signed URL, it stops working almost immediately.
- Can a resident change their submitted inspection later?
- No. Once a resident submits, that submission is locked against further changes through the link — attempts to add, edit, or delete photos in it are rejected. The link itself also expires and can be revoked independently.
- What happens to our data if we cancel?
- You can delete your account and its data from settings. Retention and deletion are described in the privacy policy. We do not sell customer data.
- Where is data hosted?
- The API runs on Railway and media is stored in Supabase. Both are named in the privacy policy along with the other processors involved in running the service.
Start documenting condition properly
Create an account and run your next inspection with the evidence trail already in place. No card required to start.
The free plan covers 3 properties and 100 photos per property.