Security
Security controls you can inspect.
See how Mongeflow isolates organizations, controls access, protects integrations, records administrative actions and handles operational incidents — and where to write when something looks wrong.
Showing: A request scoped to your organization reaches your records only.
Five straight answers
Data isolation
Every record is scoped to your organization. Isolation is enforced at the database layer with row-level security — not just in application code — so one tenant's data cannot be read from another's session.
Access and authentication
Sign-in runs through our auth provider, with SSO available and role-based access inside each organization — who can view, review, or act on a decision is a role, not a habit.
Infrastructure
Mongeflow runs on managed cloud infrastructure with traffic encrypted in transit. SOC 2 Type II certification is held by our infrastructure providers; Mongeflow does not claim a certification of its own.
Verification culture
A suite of checks runs against the live product every morning, and a recommendation is marked verified only when every check on it passes. Reliability here is a routine, not a launch-week event.
Responsible disclosure
Found something that looks wrong? Report it through the contact page — a person reads every report, and we reply within one business day.
Anything not listed here, we have not claimed. If a question matters to your review and this page does not answer it, ask — you will get the real answer, including when the real answer is "not yet".
What is enforced, and how
- Can another customer read our data?
Every record is scoped to your organization.
Row-level security in the database, not a filter in application code — so a query that forgets the scope returns nothing rather than everything.
- Is traffic protected in transit?
Strict transport security, framing denied, and a content policy.
Response headers set at the edge for every route, including HSTS, X-Frame-Options and a Content-Security-Policy.
- How do we know a webhook really came from you?
Every webhook is signed, and the signature is compared safely.
An HMAC over the payload, verified with a constant-time comparison so the check cannot be probed a byte at a time.
- How are API keys stored?
Keys are never stored in a form that can be read back.
Keys are hashed before storage; the plaintext is shown once at creation and never again.
- Can we monitor you ourselves?
A health endpoint you can poll without an account.
A public route that reports service health without leaking configuration or customer data.
- How do you know the product still works today?
The product is proved against real problems every morning.
A scheduled run solves worked examples with known answers and fails loudly when one drifts.
What this page does not claim
Written down rather than left out. A page that quietly omits its certifications invites you to assume they are there.
- A SOC 2 certification of Mongeflow itself
Our infrastructure providers maintain SOC 2 Type II certification. Mongeflow does not hold one and does not imply otherwise.
- A published penetration test
None has been commissioned. When one is, it will be named here with its date and scope.
- Customer names, logos or case studies
None appear anywhere on this site, because none has been agreed.
- Benchmark or uptime percentages
No figure is published without a source you could check. The health endpoint above is the thing you can measure yourself.
Reporting a vulnerability
Tell us through the contact page and mark it security. We will acknowledge within one business day, and we will not pursue anyone who reports in good faith and gives us reasonable time to fix it.
Report an issueAsk us the hard questions.
Security reviews get a reply from the team within one business day.