ShowFlow Security Information
How your account and your data are actually protected. Everything below is what’s built and running today, not what we plan to build.
Your password never reaches us
When you sign in, your browser proves who you are directly to AWS Cognito using SRP, a protocol that checks your password without ever sending it. ShowFlow’s own servers only ever receive a signed token. There is no password field anywhere in our API, and no password in our database, because we never have one to store. Passwords need at least 8 characters with upper and lower case, a number, and a symbol.
How you stay signed in
After you sign in, you get a ShowFlow session token that lasts 15 minutes and renews itself in the background. It lives in what’s called an httpOnly cookie, which means no JavaScript on the page can read it, ours included. It never goes into local storage. The short life is on purpose. It’s the window in which a stolen token stops working.
The database is not on the internet
Our database sits in a private network with no public access. It has no internet address at all, and the only thing allowed to connect to it is the app itself. The firewall rule names our application rather than a range of addresses. It is encrypted at rest with AWS KMS, and it has deletion protection turned on.
Everything is encrypted in transit
HTTPS only, on both this site and the API. Both send HSTS headers, which tell your browser never to try an unencrypted connection to us again. Image uploads go to storage that refuses any request that isn’t encrypted.
What we collect, and who receives it
Those are privacy questions rather than security ones, and saying them twice is how two answers end up disagreeing. The Privacy Policy is the single place they are answered: everything ShowFlow collects, the categories it deliberately does not, every service provider that receives anything, how long it is kept, and the controls you have over your profile, your export and your deletion.
What we don’t claim
Things worth knowing that a security page usually leaves out:
- Two-factor authentication isn’t offered yet. Your account is protected by your password alone, so make it a strong one you don’t use anywhere else.
- Profile photos are readable by anyone, on purpose. They show up on public profiles, so their web addresses were never secret. Everything else in storage needs permission to read.
- Deleting your account is not a total erasure. What survives it, and why, is set out in the Privacy Policy under Your rights.
Changes, and how to reach us
This page will change as ShowFlow grows. It changes the way the Privacy Policy says it does, which is the one process governing both. For questions about anything here, see Support, which carries the address that reaches a person.