Access you can explain to someone who asks
Security questions are usually answered with adjectives. Here are the actual mechanisms, including the ones that are inconvenient.
How signing in works
The largest single cause of account compromise is a password reused somewhere else. The most reliable fix is not to have one.
Credentials are treated as radioactive
The dangerous data in a platform like this is not the customer list. It is the keys that can move money and send messages.
Carrier credentials and provider tokens are write only after they are stored. They are never returned by the interface, and they are stripped out of the responses that echo them back, because several providers hand your own credential straight back to you in a response body and a naive proxy would pass that on.
Keys that agents use are stored only as a hash and are displayed exactly once, at the moment they are created. If a key is lost, it is replaced, not recovered, because a system that can show you a key again is a system an attacker can ask the same question of.
The same rule applies on the way out. When the platform calls a provider, credentials travel in headers the provider expects and are never placed in a URL where they would end up in a log.
Every action taken with a key is recorded against the account that owns it, so a compromised key has a name, a scope and a timestamp rather than an unknown blast radius.
-
Write only secrets
Stored and usable, never readable back to a person or an API caller.
-
Scrubbed responses
Upstream replies that contain your own credentials have them removed before the reply reaches you.
-
Hashed API keys
Shown once at creation and stored as a hash. Revoking is immediate and auditable.
-
Every key has a name
An action is attributable to the credential and to the account that issued it.
Company isolation
Multi-tenant software earns trust by being specific about what separates one company from another, and by not relying on the interface to enforce it.
-
Scope on every record
Every record carries the company it belongs to, and every request is resolved to a company before it reaches the data. There is no code path that returns a record outside your scope.
-
Enforced on the server
Isolation is a property of the query rather than of the screen. Hiding a button is not a security control and this platform does not use it as one.
-
Separable storage
A dedicated store per company is a configuration rather than a rewrite, because every data access goes through one internal interface. Organisations that require physical separation can have it.
-
Departments within a company
A role scoped to a district cannot reach another district, which matters when the same company runs locations that should not see each other's customers.
-
Transport security
All traffic is encrypted in transit with automatically renewed certificates, and the application follows a restrictive security header policy including a content security policy that prevents third party scripts from running in your session.
-
Protected inbound callbacks
Requests the platform receives from carriers and providers are verified before they are acted on, so a forged callback cannot create a job or move money.
Where your data physically sits, and who can see it
AlphaFlux runs on infrastructure the operator controls rather than on a shared public cloud, which changes the answer to a question more customers are asking: who else has this.
The short version is that your records are yours. They are not sold, not shared with advertisers, and not used to train anything. No third party script runs inside your session, because the interface serves everything it needs from the platform itself rather than loading it from an advertising or analytics network.
Backups are encrypted before they leave the machine that holds them. Where geographic separation is used for resilience, what travels is an encrypted artifact rather than a readable export.
Export is available at any time, in structured formats, without asking permission. A platform that makes leaving difficult is telling you what it thinks of you.
The right question is not whether the vendor says secure. It is who can see your customers, and what stops them.
Rules for the AI features specifically
Agent access is the newest risk surface in business software, and it deserves specific answers rather than being folded into general security language.
-
No path to the database
Agents act through the same validated operations your software uses. There is no route from a model to an arbitrary query.
-
Nothing sensitive in a prompt
Agents receive the context they need to act. Payment details, carrier credentials and full customer records are not put in front of a model.
-
Consequential actions need a person
Merging accounts, changing prices and bulk sending are presented as proposals for confirmation rather than performed on the model's own judgment.
-
Attributed and reversible
Every agent action is recorded with its actor, so an automation that misbehaves is identified and stopped rather than argued about.
Questions people ask before signing up
Can you see my customer data?
The platform operator runs the infrastructure and can administer it. What that means in practice is governed by the agreement you have with the operator, and the platform supports running on infrastructure you control if that is the answer you need.
Is my data used to train AI models?
No. Your records are not used to train anything. Where AI features run against a model, they receive the specific context required for the task, and the platform deliberately keeps customer identifying records and credentials out of that context.
What happens if someone leaves the company?
Their access is removed, their sessions are destroyed, and anything they did remains attributed to them in the audit trail. Nothing they wrote is deleted, because a note about a customer is part of that customer's file.
Do you use third party analytics on the platform?
No third party script runs inside a signed in session. The interface loads nothing from outside the platform, which is enforced by a content security policy rather than by a promise.
Is there a compliance certification?
The platform is designed to the practices described on this page: least privilege, hashed credentials, full audit, encrypted transport and encrypted backups. Organisations with a specific regulatory requirement should raise it, because the architecture supports dedicated storage and regional hosting where that is what a rule demands.
Start on the free plan
Twenty customers, one location, every core module, free permanently. Move up when the work outgrows it.