← All docs
08 · DOCUMENTATION

Security

Encryption at rest, per-workspace isolation, versioning, and SSO.

OpFlow runs on Supabase (Postgres/Auth) behind a Cloudflare Pages SSR worker. Security is built into the data model, not bolted on.

  • Credentials are encrypted at rest — tokens are never stored in plaintext.
  • Row-level security on every table isolates each workspace's data; you only ever see your own.
  • Every workflow is versioned with one-click rollback, so a bad change is never permanent.
  • SSO token exchange with replay protection is available on Team — SSO-ready, gated to the plan (not yet GA for every workspace).

We don't publish a SOC 2 / data-residency page yet. If you're evaluating for a regulated environment, talk to us about where the roadmap stands.