Security
Security and data protection.
Your audience trusts you with their messages and orders. Here’s how we protect them.
Security practices
Encrypted in transit
Every connection to FandomFlow, our API and your store uses HTTPS (TLS).
Payment credentials encrypted at rest
Payment gateway keys you connect for payouts are encrypted with a dedicated key before they are stored.
We never see card details
Customers pay on Razorpay’s or PayU’s secure checkout. Card and UPI details never touch our servers.
Verified webhooks
Events from Instagram, Razorpay and PayU are checked against their cryptographic signatures before we act on them.
Workspace isolation
Every record belongs to a workspace, and every request is checked against your membership and role.
Roles & permissions
Owners, admins and members get different access. Billing and settings are limited to owners and admins.
Account protection
Email verification, rate-limited sign-in and password reset, and CSRF protection on every form.
You control your data
Disconnect Instagram, delete data or ask us to erase your account at any time.
Report a vulnerability
If you believe you’ve found a security issue, email {{SUPPORT_EMAIL}} with the details. Please give us reasonable time to fix it before sharing it publicly. Read our Privacy Policy for how we handle personal data.