Effective September 17, 2026.
Sign-in and sessions
Passwords are stored as salted scrypt hashes; Flora cannot read them back. Sessions are server-side rows referenced by an HttpOnly, SameSite, Secure cookie signed with a server secret; only a hash of the session secret is stored, so a copy of the database yields no usable cookie. Sessions expire after inactivity and after an absolute limit, and any session can be signed out from the account page. Repeated failed sign-ins lock the email-and-address pair for a while.
Tenancy
Every company file belongs to one tenant. Every read and write goes through one scoping layer that filters by the signed-in user’s tenant and role; an agent sees their book, a carrier sees its own tenant, an insured sees one policy, and the Flora team sees everything in order to run the service. Every page and every API route enforces its own gate; the navigation only hides what you cannot open.
Append-only audit log
Every change to a file writes an audit row: who, what, when, before and after. Database triggers refuse UPDATE, DELETE and TRUNCATE on that table, and the application checks on boot that the triggers are installed before it will serve a write.
In transit and at rest
Every connection to Flora is over TLS, terminated at the hosting provider’s edge. The database is reachable only from the application over the provider’s private network. Uploaded documents are stored with their content type checked and their size capped; Flora serves them back only to people attached to the file.
Forms and browsers
Every state-changing request must come from this site (origin check) and carry a per-visit token (synchronizer token). Pages ship a strict Content-Security-Policy with a per-request nonce; no third-party scripts run. Flora never receives card details: payments are entered in Stripe-hosted checkout.
Reporting a security issue
If you find something that looks like a security problem, write to us through the contact page with the topic “Security report”. Include what you saw and how to reproduce it; do not include another person’s data. Security reports are read first. Please give us a reasonable time to fix an issue before describing it publicly, and do not test against accounts that are not yours.