Skip to main content
This page describes the security practices behind Just Flow It: the web app at justflow.it, the public API, the connector for AI assistants (MCP) and the Jira app. For what personal data we collect, why we collect it and your rights, read the privacy policy.

​
Hosting and data location

  • Your diagrams and account data are stored in the European Union, in the AWS Frankfurt region (eu-central-1).
  • The database, the sign-in service and file storage run on a server we operate in that region, using the open-source Supabase stack.
  • The web app is hosted on Vercel. Its server functions run in Vercel’s Frankfurt region (fra1), and pages are delivered through Vercel’s global network.

​
AI processing and data residency

Which AI provider handles a request depends on your organization’s AI residency setting.
  • Global (the default, and the setting for personal workspaces): diagram generation and editing, chat and automatic titles run by default on Anthropic’s Claude models through the Anthropic API. Google Cloud handles audio transcription, process document drafting and any other request we route to it, including when Anthropic is unavailable. Processing can take place outside the EU.
  • European Union (Team plan): the organization’s content is never sent to the Anthropic API. All of its AI processing runs on Google Cloud within the EU.
  • Audio transcription always runs on Google Cloud within the EU, whatever the setting.
  • If we can’t confirm an organization’s setting when a request arrives, we handle the request as EU.
  • The anonymous preview on our homepage, used without an account, runs on Google’s Gemini API.
Only the organization owner can change the setting, and each change is recorded in an audit log. See Data privacy for how to switch. How each AI provider may use and keep this content is described in sections 4 and 7 of the privacy policy.

​
Encryption

​
In transit

  • The web app, the public API and our backend server serve content only over HTTPS. Plain HTTP requests are redirected to HTTPS.
  • The web app sends an HTTP Strict Transport Security (HSTS) header with a two-year lifetime, a Content Security Policy, and headers that stop other sites from embedding the app in a frame.

​
At rest

  • The server disk that holds the database and uploaded files is encrypted with Amazon EBS encryption, using a key in AWS Key Management Service (KMS).
  • Daily snapshots of that disk are encrypted.
  • Nightly database dumps are stored in Amazon S3 with AES-256 server-side encryption.
  • The backend server’s secrets, such as database passwords and token signing keys, are stored as encrypted parameters in AWS Systems Manager Parameter Store.

​
Access control

​
Accounts and sign-in

  • You sign in with an email address and password, or with Google.
  • New email and password accounts must confirm their email address.

​
Database access rules

  • Row-level security is turned on for the application’s database tables. It limits what a signed-in user’s requests can read and change. For example, a diagram can only be read or changed by its owner, or by members of the organization it belongs to.
  • Requests to the public API and the MCP server are scoped in code to the diagrams and folders of the account or organization that owns the API key or connection.

​
API keys

  • API keys are available on the Pro and Team plans. You create and revoke them in Settings > API keys.
  • Each key carries scopes (read or write access to diagrams and folders, and AI generation), and every request is checked against them.
  • We show the full key once, when you create it, and store only a SHA-256 hash of it.
  • A revoked key is refused on its next request.
  • For an organization, only the owner can create or revoke keys.

​
AI assistant connections

  • ChatGPT, Claude, Cursor and other assistants connect by signing in with your Just Flow It account through OAuth, with PKCE.
  • Access tokens last one hour. Each refresh token works only once and is replaced by a new one, and a connection must sign in again after 180 days at most.
  • We store only SHA-256 hashes of authorization codes and tokens. If an authorization code is presented twice, or a refresh token is presented again more than 30 seconds after it was used, we end that sign-in.
  • You can remove a connection in Settings > AI connections. The assistant’s next request is refused.

​
Files

  • Files you attach in the AI chat (images, documents and audio) are kept in private storage. The app serves them only to the account that uploaded them, through signed links that expire within five minutes.
  • A read-only share link lets anyone who has the link view a diagram without an account. Each link contains a random token and is excluded from search engine indexing.
  • A share link can be revoked at any time, which disables it.

​
Infrastructure access

  • The backend server accepts connections on HTTPS (port 443) and on port 80, which is used only to renew TLS certificates and to redirect to HTTPS. The database port is not exposed to the internet.
  • There is no SSH access to the server. Administrative access goes through AWS Systems Manager and requires AWS permissions.
  • The production server has termination protection, and its disk is kept even if the server is deleted.

​
Backups and recovery

  • Disk snapshots: a snapshot of the server disk is taken once a day, and the last 7 are kept.
  • Database dumps: a full dump of the database is uploaded every night to a separate Amazon S3 bucket. The bucket blocks all public access and keeps object versions. Each dump expires after 35 days and is permanently removed 7 days later.
  • Both kinds of backup stay in the AWS Frankfurt region (eu-central-1).
  • When we set up the nightly dumps in June 2026, we downloaded the first dump from storage and checked with pg_restore that it was a readable archive.

​
Data deletion

  • Your account: delete it in Settings > Security, or write to contato@justflow.it from the account’s email address. Deletion is scheduled with a 30-day grace period, and you can cancel it during that time. After the grace period, a daily job permanently deletes the account and the personal data linked to it, including your diagrams, folders, chats and the files you attached in chat. Active subscriptions are canceled.
  • Organizations you created: when your account is deleted, an organization with other members is handed over to one of them. An organization where you are the only member is deleted.
  • AI usage records: these are kept without the link to your account until they reach the retention period in the privacy policy.
  • An organization: only the owner can delete it. Its subscription is set to end with the current billing period, and the organization and its content are permanently deleted 60 days after that date, or 60 days after the request when no billing period is running. Until then, the owner can restore it. Once the subscription has ended, restoring requires a new subscription.
  • Backups: existing backups are not edited after a deletion. Deleted data stays in them until they expire on the schedule in Backups and recovery.
Retention periods for each kind of data are listed in section 8 of the privacy policy.

​
Application security practices

​
Rate limits

  • Public API and MCP server: per account, 120 requests per 60 seconds and 500 AI generations per rolling 30 days, shared by all of the account’s keys and connected assistants. See Rate limits.
  • Anonymous AI generation on the homepage: limited per visitor per day, using hashed IP addresses and device fingerprints.
  • Email sharing: up to 20 recipients per user in a rolling 24 hours.
  • Changes to share links, BPMN file imports and the registration of new OAuth clients have their own request limits.

​
Review and testing

  • Every pull request to the web app and public API, and every change to its main branch, runs automated type checking, linting and tests.
  • For changes to the web app and public API that touch the API, authentication, data access, file storage or billing, or that add a third-party dependency, our written release process calls for a security review by AI reviewer agents before merge. Automated checks do not enforce this step.

​
Dependencies

  • In the web app and public API, dependency versions are pinned in a lockfile, and the automated checks install exactly those versions.

​
Jira app

The Just Flow It app for Jira runs on Atlassian Forge.
  • It stores your Just Flow It API key in Forge secret storage.
  • Outside Atlassian, it can send requests only to justflow.it, over HTTPS.
  • It asks for these permissions: read Jira work items (read:jira-work), app storage (storage:app) and personal data reporting (report:personal-data).
  • It reads the current work item’s title and description when you open its panel, and sends the text to Just Flow It only when you choose Generate BPMN.
  • Disconnecting removes the saved key and the work item links from Forge. It does not revoke the key in Just Flow It. To revoke it, go to Settings > API keys.
  • When Atlassian reports that an account was closed, the app deletes the connection data it stored for that account.
More detail: Jira integration: privacy and data use.

​
Certifications

Just Flow It does not hold SOC 2 or ISO 27001 certification.

​
Subprocessors

The service providers that process personal data for us, with their purpose and region, are listed in section 6 of the privacy policy.

​
Report a security issue

Email contato@justflow.it with “Security” in the subject line. Include:
  • What you found and where: the URL, API endpoint or app.
  • The steps to reproduce it.
  • The impact you expect.
Test only against your own account and data, and don’t run tests that slow down or interrupt the service for other people. Don’t include passwords or working API keys in your message. This page describes our practices as of October 2026.