Security & Data Protection

Last updated: November 5, 2026

This page lists the security measures RSFlowHub actually has in place today, what we do not offer yet, and how to report a problem. We only list controls that exist in the product.

1. Accounts and sign-in

All traffic to the website and API uses HTTPS.
Passwords are stored only as one-way hashes. You can also sign in with a one-time email code, Google or GitHub.
Sign-in and code-verification attempts are rate limited.
Changing or resetting your password signs out your other devices, and you can sign out all other devices yourself from Settings → Security.

2. API keys

Each API key is shown once when it is created. We store only its SHA-256 hash, so nobody at RSFlowHub can read it back.
You can have several named keys (for example one per app or environment) and revoke any one of them in the dashboard. A revoked key stops working immediately, and we email you whenever a key is created or revoked.
Keep keys on your server. Never put them in browser or mobile app code. The chat widget and forms use separate public tokens that can be locked to your own domains.
You can set a monthly spending limit so a leaked key cannot run up unlimited charges.

3. Isolation and abuse protection

Every knowledge base, document, chatbot, form and log is scoped to the account that owns it.
API calls are rate limited per plan; the chat widget and forms have their own per-visitor limits and daily caps that you control.
Visitor text sent through the chat widget and forms is stripped of HTML before it is stored, and links are restricted to http, https and mailto.
Webhook targets for Forms must be public HTTPS addresses, and each delivery is signed (X-RSFlowHub-Signature).

4. How your API data is handled

No training: RSFlowHub never uses your requests or results to train AI models, and we never sell your data.
AI processing: the text you send is forwarded to the AI provider configured for that endpoint (OpenAI, Google Gemini, DeepSeek or xAI Grok) only to produce your result. Knowledge-base documents are sent to Perplexity to create search vectors. The full list of sub-processors is in our Privacy Policy.
Automatic fallback: if a provider fails or is paused by our circuit breaker, the request is retried on a backup model. The price does not change; failed calls are not charged.
Request logs: we record metadata only: endpoint, sizes, credits, status, latency and a request ID. Logs do not store your request text or the result.
Caching: identical requests to some endpoints may be answered from a cache for up to 24 hours. Chat and image generation are never cached.
Request IDs: every API response carries an X-Request-Id header. Include it when you contact support so we can find the exact call.
Your content: knowledge bases, documents and chatbot conversations you create are stored so those features work, and you can delete them at any time. Chat widget and Forms data is deleted automatically after the retention period you choose.

5. Payments

All payments are processed by Razorpay, a PCI DSS compliant payment provider. Card and bank details are entered on Razorpay’s checkout and never reach our servers.

6. What we do not claim

RSFlowHub is not certified under SOC 2, ISO 27001 or HIPAA, and has not yet had an independent penetration test. Do not send data that legally requires those certifications.
We do not offer zero data retention: see the caching and logging rules above.
We do not currently offer a contractual uptime guarantee (SLA). Live health is on the status page.

We will update this section when any of this changes, and we will never list a certification we do not hold.

7. Reporting a vulnerability

If you find a security issue, please email security@rsflowhub.com with the steps to reproduce it. We aim to acknowledge reports within 2 business days and to keep you updated until it is fixed.

Please do: test only against your own account and data, stop as soon as you confirm the issue, and give us reasonable time to fix it before sharing it publicly.
Please do not: access or change other customers’ data, run denial-of-service or load tests, use social engineering, or spam our forms and widgets.
We will not take legal action against research done in good faith within these rules. We do not run a paid bug bounty yet, but we are happy to credit you.

Our contact details are also published in /.well-known/security.txt.

Security acknowledgements

We thank these researchers for reporting issues responsibly:

kta1kri, November 2026: access control issue in the chatbot API.

Found a bug that is not a security issue? Our testers page explains how to report it and get credited.

8. If something goes wrong

If we learn of a security incident that affects your account or data, we will tell you by email without undue delay, explain what happened and what we are doing about it, and meet any legal notification duties that apply (including reporting to CERT-In in India).

9. Contact

Security: security@rsflowhub.com
Privacy: support@rsflowhub.com