Security at ClaimFlow.
Your claim data is sensitive. We treat security as a core feature, not an afterthought.
How we protect your data
Multiple layers of security protect your information at every step.
Encryption at Rest
All sensitive data stored in our database is encrypted using Fernet symmetric encryption. Your claim documents and extracted data are protected even at the storage level.
Encryption in Transit
All communication between your browser and our servers is encrypted with TLS/SSL. API requests, file uploads, and data transfers are protected during transmission.
Enterprise Authentication
Powered by Clerk, our authentication supports SSO, multi-factor authentication, and role-based access control. Every API request is verified with JWT tokens signed by RS256.
PCI-Compliant Billing
All payment processing is handled by Stripe, a PCI DSS Level 1 certified provider. We never store, process, or have access to your credit card information.
Tenant Isolation
Each organization's data is logically isolated. Users can only access claims and reports belonging to their own organization. Role-based permissions control what each team member can see and do.
No Data Sharing
Your documents and extracted data are never shared with third parties, sold to data brokers, or used for model training. Your client information remains completely private.
Infrastructure Security
Cloud Hosting
ClaimFlow runs on Railway's managed infrastructure with automatic TLS certificates, DDoS protection, and isolated container deployments. Our database uses PostgreSQL with encrypted connections (SSL required), connection pooling, and automatic backups.
Application Security
Our application follows OWASP security best practices including input validation on all user inputs, parameterized SQL queries to prevent injection attacks, CORS protection, rate limiting on all API endpoints (both per-user and global), secure HTTP headers, and CSRF protection. Non-root container deployment further limits the attack surface.
Error Monitoring
We use Sentry for real-time error tracking and monitoring. Personal data is scrubbed from error reports before transmission. We actively monitor for security anomalies and respond to incidents promptly.
Document Processing Security
Documents sent for extraction are processed in real-time and are not stored or used for model training. Processing logs are retained for up to 30 days for safety monitoring, then deleted automatically. All communication uses encrypted HTTPS connections.
Authentication Security
Authentication is handled by Clerk, which provides enterprise-grade security including JWT tokens verified via JWKS (JSON Web Key Sets), RS256 cryptographic signing, issuer and audience claim verification, and automatic token expiration. Our authentication system fails closed — if verification cannot be completed, access is denied.
Billing Security
All billing enforcement uses atomic database operations to prevent race conditions. Subscription status is verified server-side on every billing-relevant request. Webhook signatures are cryptographically verified to prevent tampering. We never store payment card data on our servers.
Security questions or concerns?
If you have questions about our security practices, need to report a vulnerability, or require additional security documentation for your organization's review process, please reach out.