Authentication
Clerk manages email sign-in, verification, recovery, logout, and session tokens. Protected functions verify the session server-side and return safe errors without secrets or stack traces.
Security Overview
Flux uses authenticated access and protected server functions to reduce unnecessary exposure of SME business records. This page describes safeguards in the current product; it is not a certification or guarantee.
Workspace isolation
Protected operations resolve the signed-in user and workspace membership before reading or changing records. Browser-supplied workspace IDs are not treated as permission.
Storage and transport
Flux uses HTTPS in production, protected server-side storage, workspace-scoped records, and encrypted payload helpers where configured. Provider-level encryption-at-rest and backup settings must be confirmed in the production database dashboard.
Network controls
Netlify headers include HSTS, content-type protection, frame denial, referrer policy, restricted browser capabilities, no-store API responses, and an allowlisted content security policy.
Privacy-safe operations
Operational logs should use reference IDs and avoid passwords, tokens, cookies, salary details, invoice contents, bank information, or full employee records. Admin telemetry is isolated by configured allowlists.
Report a concern
Send suspected account or data-security issues to Kimhongtaing25@gmail.com with no secrets or credentials. See support for safe reporting instructions.