Security

How we keep your data safe.

Your money

FlowPay never holds your funds or your clients' funds. Payments settle directly to your own Stripe account through Stripe Connect. FlowPay computes the splits and orchestrates the collection, but money moves between your clients and your Stripe account, never into a FlowPay balance. FlowPay is also not for trust or IOLTA money: it handles professional service fees only.

Card data

FlowPay never sees, stores, or transmits card numbers. Every payment link is Stripe-hosted checkout: card data goes straight to Stripe infrastructure and never touches FlowPay systems.

Stripe partnership

FlowPay is built on Stripe Connect. All money movement is executed by Stripe; FlowPay computes the splits and orchestrates the API calls.

Data hosting

All FlowPay infrastructure runs on AWS US (us-east-2 primary). Application data is encrypted at rest and in transit. Backups are encrypted, geo-redundant, and tested quarterly.

Subprocessors

• Stripe — payment processing, KYC, money movement
• AWS — application + data hosting (us-east-2)
• Auth0 — authentication

GDPR & privacy

Standard contractual clauses and a DPA available on request. See our DPA and privacy policy.

Reporting a vulnerability

Email security@takeflowpay.com. We respond within 24 business hours.