Security at FLXR

Customer data in Firestore is owner-scoped. Reads and writes require Firebase Authentication: security rules check that request.auth is present and that the authenticated user matches the document owner. Unauthenticated access is denied. Sensitive operations such as billing, credits, and licensing run through our server layer (Firebase Admin), not from arbitrary client devices.

In practice: one agency's leads, shift data, and client context are not readable or writable by another tenant.

During agent shifts, proposed replies and posts go through an approval queue. A human — you or a teammate you authorize — must approve before anything is published to Reddit or X. The agent drafts; it does not get a free pass to post live content on its own.

That gate is the product's core brand-safety control for client work. Optional scheduled workflows may use a separate pre-approval path only when you explicitly opt into a plan that marks items as pre-approved.

Traffic between your browser, the FLXR macOS app, and our services uses TLS/HTTPS. Production responses include HTTP Strict Transport Security (HSTS). Data at rest is stored on Google Cloud (Firestore), which encrypts customer data by default. Social platform session credentials we store server-side are additionally encrypted at the application layer (AES-256-GCM) and are not readable from client devices.

FLXR administrator accounts are protected with TOTP-based two-factor authentication (authenticator app), with recovery codes and lockout after repeated failed attempts. You can also sign in with Google so access can ride on the Google Workspace account your agency already controls. Extending 2FA to all end-user accounts is on our roadmap; we do not claim it is live for every user today.

Subscription checkout and billing run through Stripe. Card details are entered on Stripe's hosted checkout and are never stored on FLXR systems. We retain only the Stripe customer and subscription identifiers needed to run your account, plus normal billing metadata.

FLXR uses third parties to process customer data as needed to run the product:

• Google Cloud / Firestore — storage of account, lead, shift, and related product data
• Stripe — payment processing and billing
• Resend — transactional email
• a hosted AI model provider — evaluation of social post content when the remote (tier-3) path runs

Post content evaluated in tier 3 is transmitted to that hosted model. On-device evaluation via Apple Foundation Models applies only on macOS 26 or later with Apple Intelligence enabled. On machines that do not meet that requirement, or when Apple Intelligence is unavailable, evaluation uses the hosted model.

FLXR never transmits the customer's social platform passwords to any AI model.

If your agency needs a DPA for client or procurement review, a draft template is at flxr.ai/legal/dpa. That page is marked as a template pending legal review — not an executed agreement. Email privacy@flxr.ai to request a counsel-approved copy for your account once available.

We retain account data while your account is active and as needed to provide the service. You can delete your account from the dashboard (Settings → Delete My Account) or by emailing privacy@flxr.ai. Details are in our Privacy Policy. For security questions from your team or clients, use the same address — a human will respond.

What we do not claim

We do not currently claim SOC 2, ISO 27001, or similar third-party certifications. Those may become goals as we grow; we will state them only after an auditor confirms them. On our nearer-term security roadmap: 2FA for all users, deeper account audit logs, and SAML SSO for larger teams.