Security & Data Protection

We build systems that sit inside other companies' phone lines, inboxes, and books. That only works if the security posture is boring, explicit, and verifiable. This page describes how we handle security, plainly, without badges we haven't earned.

1. Principles

• Least privilege. Agents and our team get the narrowest access that the workflow needs: scoped API keys, accounts limited by role, nothing shared.
• Infrastructure the client owns. Deployments run in accounts the client controls wherever possible. You can revoke our access at any time without breaking your ownership of the system.
• Explicit boundaries. Every agent has a written definition of what it may do, what it must never do, and when it must hand off to a human. Consequential actions need a human to sign off.
• Auditability. Agent actions are logged. Transcripts, decisions, and writes to client systems are traceable after the fact.
• No training on your data. We do not use client conversation data to train models of our own, and we configure model providers' no training and zero retention options where available.

2. The website

• Served exclusively over HTTPS with HSTS; static pages on a global CDN (Netlify), which absorbs traffic spikes and denial of service noise by design.
• Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a restrictive Permissions-Policy.
• Cookieless analytics: nothing is stored on your device; no third party ad scripts anywhere on the site.

3. Client engagements

• Credentials are exchanged through secure channels and stored in a password manager with access limited to the people on your engagement.
• Data in transit between agents and your systems is encrypted (TLS). Where a workflow stores data at rest, it lives in your systems, under your retention rules.
• We work to practices aware of GDPR and, for deployments close to healthcare, design within the client's compliance framework (for example limiting what an agent may hear, store, or write). We state plainly what we are not: GenovaFlow does not currently hold SOC 2 or ISO 27001 certification, so the practices above are contractual commitments instead.
• Offboarding is clean: access revoked, credentials rotated by you, and everything we built stays with you.

4. Subprocessors for this website

Netlify (hosting), Cal.com (scheduling), PostHog EU (cookieless analytics), and Supabase (blog contact form). Client deployments document their own subprocessor list per engagement.

5. Reporting a vulnerability

Found something? Email contact@genovaflow.com with "SECURITY" in the subject. We read those first, we won't threaten good faith researchers, and we'll tell you what we fixed.