Security

Your Data, Protected

Enterprise-grade security built for organizational trust

How We Protect Your Data

FlockWorker handles sensitive organizational data — member information, payroll, financial records, and governance decisions. We take that responsibility seriously with multiple layers of protection.

Encryption & Headers

Industry-standard encryption protects your data at every stage, with strict browser security policies.

Data in Transit: All connections use TLS 1.3 encryption. HSTS headers enforce HTTPS across all requests.

Data at Rest: AES-256 encryption provided by our database infrastructure. Backups are encrypted using the same standard.

Content Security Policy: Per-request nonce-based CSP headers prevent cross-site scripting. Script sources are locked down with strict-dynamic policy.

Security Headers: X-Frame-Options: DENY, form-action and base-uri restrictions, object-src: none, and upgrade-insecure-requests in production.

Authentication & Access

Centralized identity management with granular, server-enforced permissions.

Single Sign-On: Authentication is handled exclusively through EconChangers OAuth 2.0 / OpenID Connect with PKCE, state, and nonce validation.

Multi-Factor Authentication: MFA is fully delegated to EconChangers. Session tokens reflect MFA verification status for step-up authentication on sensitive operations.

Role-Based Access Control: Granular permissions are enforced server-side through fail-closed proxy middleware. Every non-public route requires authentication.

Session Security: Production cookies use the __Secure- prefix. Sessions include verified claims for user identity, organization membership, and role assignments.

Data Protection

Strict boundaries ensure your organization's data stays private and tamper-proof.

Tenant Isolation: All database queries are scoped to the authenticated user's organization. Cross-tenant data access is architecturally prevented through organization-scoped queries.

Input Validation: All user input is sanitized. SQL queries use parameterized statements through our ORM. Email templates HTML-escape all user-provided data.

File Upload Security: Uploaded files undergo magic-byte content validation. SVG uploads are blocked to prevent XSS. Sensitive downloads use HMAC-signed, time-limited tokens.

CSRF Protection: Origin validation is enforced for all mutating requests. Server Actions provide built-in CSRF protection through the framework.

Infrastructure & Monitoring

Proactive safeguards and real-time monitoring keep your platform secure.

Rate Limiting: IP-based and user-based rate limiting protects against brute-force attacks and abuse across authentication, API, and public endpoints.

Modular Access Enforcement: Module access is enforced at the proxy middleware, server action, API route, and background job layers. Disabled modules cannot be accessed at any level.

Audit Logging: Security events are tracked and surfaced through an admin dashboard for monitoring authentication activity, access patterns, and anomalies.

Error Monitoring: Application errors are captured in real-time through Sentry integration with proper data scrubbing to prevent sensitive information exposure.

Vulnerability Disclosure

Report a Vulnerability

We welcome responsible disclosure from security researchers and the community. If you discover a potential vulnerability, please let us know so we can address it promptly.

Contact: security@econchangers.com

Response Time: We acknowledge reports within 48 hours and aim to provide a resolution timeline within 5 business days.

Scope: All EconChangers properties including FlockWorker (flockworker.econchangers.com), the EconChangers identity platform, and associated APIs.

Safe Harbor

We consider security research conducted in good faith to be authorized activity. We will not pursue legal action against researchers who discover and report vulnerabilities responsibly, provided they avoid data destruction, service disruption, and access to other users' data.

Questions About Security?

If you have questions about our security practices or need additional details for your organization's evaluation, we're happy to help.

Contact Security Team Become a Pilot Partner

Features Pricing

Loading content...

Human Resources

Finance & Payroll

Inventory

Security

How We Protect Your Data

Encryption & Headers

Authentication & Access

Data Protection

Infrastructure & Monitoring

Vulnerability Disclosure

Report a Vulnerability

Safe Harbor

Questions About Security?

Security

How We Protect Your Data

Encryption & Headers

Authentication & Access

Data Protection

Infrastructure & Monitoring

Vulnerability Disclosure

Report a Vulnerability

Safe Harbor

Questions About Security?