Security

Account and data access

HomeFlow uses account authentication and user-scoped access controls intended to keep one homeowner’s cloud records separate from another’s. Account sessions are managed through Supabase-supported authentication.

Files and network transport

HomeFlow-managed uploaded files use private storage access rather than public file listings. Temporary access links may be opened when a signed-in user requests a file. Network transport protections are provided by the application and its service-provider infrastructure.

Account deletion safeguards

The verified deletion workflow requires an authenticated session, acknowledgement, and reauthentication. Server-side authorization controls the destructive operation. The workflow deletes covered account-scoped database records and HomeFlow-managed files before removing the authentication account, then purges attributable local state and returns the application to a signed-out state.

Operational safeguards

Release verification has included access-isolation checks, deletion sequencing, candidate-integrity checks, sanitized logging review, and synthetic cleanup. Secrets and service-role credentials are not intended to be embedded in the client application.

Your role

Use a unique password, protect access to your email account and device, sign out on shared devices, and do not upload information you do not want stored in HomeFlow. No system can guarantee absolute security.

Responsible security reports

Send suspected security vulnerabilities to security@homeflow247.com. Include enough non-sensitive detail to help HomeFlow understand the issue. Do not include passwords, access tokens, private keys, or another person’s personal data, and do not disrupt the service or access data without authorization.

For account support, use support@homeflow247.com. For privacy questions, use privacy@homeflow247.com.

What this page does not claim

This page does not claim a certification, formal compliance attestation, penetration-test guarantee, bug-bounty program, response-time commitment, or immunity from security incidents. Additional operational and legal policies remain subject to approval.