Security
Security
Last updated: [Date]
[DRAFT — needs legal review] This text is a working draft written by the team, not reviewed by counsel. It must be reviewed and approved before the site launches.
RhoeFlow is in private development. This page describes our current practices and will be expanded as the product moves toward general availability. [Security lead to review.]
This website
- Served over HTTPS from Cloudflare's edge as static pages. The only server-side code is the contact form endpoint.
- The contact form is protected by Cloudflare Turnstile. Submissions are validated and sent to our team by email; nothing is stored in a database on this site.
- Secrets (API keys) live in Cloudflare's encrypted environment, not in the code repository.
The RhoeFlow application
- Sign-in and team access are provided through Trade OS, EcoSource IQ's shared account layer. [Confirm authentication provider and MFA availability.]
- Assessment data, calculation runs and reports are owned by your company. Jobs, photos and video stay in WorkEdge Pro. [Confirm data residency and backup details.]
- Calculation runs are frozen with their inputs and engine version so results can be reproduced and audited.
- [Encryption at rest and in transit, access controls, logging, sub-processors: to be documented.]
Reporting a vulnerability
If you believe you have found a security issue in this site or in RhoeFlow, email info@rhoeflow.com with the details. We will acknowledge your report within one business day. Please give us a reasonable time to fix the issue before sharing it publicly. [Consider a dedicated security@ address and a security.txt file.]