Security & trust
Built secure
from the database up.
Tenant isolation as a core database-level control — not just a front-end filter. Every read and write is scoped, authenticated, and authorized before data is returned.
01 — Infrastructure
Where your data lives.
EvalFlow runs on Supabase infrastructure built on AWS. Supabase maintains SOC 2 Type 2 compliance for its platform and underlying cloud operations.
Cloud infrastructure
Hosted on Supabase (AWS). SOC 2 Type 2 certified infrastructure with automatic backups and high availability.
Database
PostgreSQL with row-level security enforced on every table containing user data. The database itself rejects unauthorized queries.
Encryption
TLS 1.2+ for all data in transit. AES-256 encryption at rest via AWS. API keys and credentials stored as server-side secrets — never exposed to frontend code.
Serverless functions
All backend logic runs in isolated serverless functions. Each invocation authenticates the caller via JWT before executing. No persistent server state between requests.
02 — Tenant isolation
Your data is separated
from every other customer.
Tenant separation is not a front-end filter. EvalFlow combines database-level security, authenticated access, and server-side authorization so each customer's workspace remains logically separated from all others.
Customer-data tables are scoped to the organization they belong to at the database level.
PostgreSQL row-level security policies ensure users only access records associated with their authorized organization.
Backend functions verify the caller's identity and organization before performing any privileged actions.
Isolation enforced across all core modules — people data, performance workflows, feedback, reviews, surveys, and admin settings.
03 — Access control
Role-based access for every
level of the organization.
Permissions are enforced through database security policies, authenticated user context, and server-side authorization checks — not just application logic.
| Role | Data visibility | Enforcement |
|---|---|---|
| Administrator | Organization-level visibility across authorized modules and settings | Role checks, row-level security, and server-side controls |
| Team lead | Own data and authorized visibility into direct or indirect reports | Reporting-line access checks and database-level policies |
| Employee | Own profile, assigned work, feedback, reviews, and records they are authorized to access | Authenticated-user matching and row-level security |
Feedback & reviews
Employees see their own records. Team leads see authorized team records. Admins access org-level workflows where permitted.
Pulse surveys
Individual responses are not exposed in team lead dashboards. Insights are presented through authorized, aggregated views only.
Private feedback
Restricted to the users involved. Not surfaced broadly across the organization.
Talent grid & analytics
Limited to authorized administrators and leadership roles based on company permissions.
04 — Authentication
Enterprise-grade
identity management.
Email and password login, two-factor authentication, and enterprise single sign-on — with JWT-based sessions that re-validate identity on every API call.
Enterprise SSO
SAML and OIDC via a dedicated SSO provider. Admin self-service configuration. Domain-based detection at login. Enforce SSO org-wide — no local password fallback.
Multi-factor auth
TOTP-based 2FA via authenticator app. Company-level controls: optional or enforced globally. Required for sensitive operations like password resets.
Session security
JWT-based authentication with short-lived tokens. No session data stored in cookies. Every API call re-validates the user's identity and authorization level.
05 — AI & data governance
AI that operates within
the same access model.
EvalFlow's AI features operate within the same security, access-control, and tenant-isolation model as the rest of the platform.
No training on your data. EvalFlow does not use your organization's data to train, fine-tune, or improve AI models.
Same access rules apply. AI responses surface only information the requesting user is authorized to access.
AI activity is logged. Interactions are recorded server-side for governance, troubleshooting, and accountability.
Server-side API key handling. AI provider credentials are stored as server-side secrets — never exposed in the browser.
06 — Integration security
Secure third-party
connections.
Integration credentials are handled server-side and never exposed in the browser. Access is limited to the permissions required for each connected workflow.
| Integration | Auth method | Data flow |
|---|---|---|
| Slack | OAuth 2.0 | Authorized EvalFlow notifications to selected Slack destinations. |
| Microsoft Teams | Microsoft identity / app authorization | EvalFlow notifications and workflow updates to authorized Teams destinations. |
| HRIS connections | Provider authorization / secure connector | Employee, department, and reporting-line data for performance workflows. |
| Stripe | API key + webhook signatures | Billing and subscription workflows. Webhook events verified server-side. |
| Server-side API key | Transactional emails — invitations, reminders, notifications, account messages. |
08 — Compliance
Transparent about where
we stand today.
We believe transparency about our security posture is more useful than vague claims. Here is exactly where EvalFlow stands.
| Standard | Status | Detail |
|---|---|---|
| Infrastructure SOC 2 Type 2 | Active | Hosted on Supabase infrastructure, which maintains SOC 2 Type 2 compliance for its platform and underlying cloud operations. |
| Encryption in transit | Active | Modern TLS encryption for all data transmitted between users, EvalFlow, and supported service providers. |
| Encryption at rest | Active | Data at rest protected through encryption capabilities provided by Supabase and its underlying AWS infrastructure. |
| Data privacy readiness | Active | Tenant isolation, access controls, deletion workflows, and customer security questionnaires supported. |
| EvalFlow SOC 2 | Planned | Application-level SOC 2 readiness and audit work is on EvalFlow's roadmap as the platform scales with larger customers. |
Security is a database-level constraint here — not an application-level promise.
Questions from your IT,
security, or legal team?
We're happy to complete your security questionnaire or schedule a call with your IT team to walk through our architecture, controls, and data flows in detail.
DPA, subprocessor list, privacy policy, and SSO documentation available on request.
What IT teams ask us
Does EvalFlow has its owner SOC 2 Certification?
Our infrastructure provider (Supabase/AWS) maintains SOC 2 Type 2 certification. EvalFlow's application-level SOC 2 Type 1 audit is on our roadmap. In the meantime, our security architecture — database-level tenant isolation, row-level security on every table, and server-side credential management — provides controls that many SOC 2 certified applications implement at the weaker application layer. We're happy to walk your team through the technical details.
Can another customer's admin see our data?
No. Tenant isolation is enforced at the PostgreSQL level. Every query — whether from the UI, API, or AI assistant — is scoped to the authenticated user's organization by the database itself. There is no application-level toggle or admin override that could expose cross-tenant data.
Is our data used to train AI models?
No. Your data is never used for AI model training by EvalFlow or any third-party provider. Our AI providers do not retain or train on data submitted through their APIs. The AI assistant accesses your data in real time within the same access control boundaries as the logged-in user, and all interactions are audit-logged.
Can you fill out our security questionnaire?
Yes. Use the contact form to request it, and we'll return it completed, typically within one week. We also offer a live architecture walkthrough with your IT team if that's more efficient.
Do you support SSO with our identity provider?
Yes. EvalFlow supports enterprise SSO via SAML 2.0 and OIDC. We're compatible with Okta, Azure AD, Google Workspace, OneLogin, and any SAML/OIDC-compliant identity provider. SSO enforcement can be enabled per organization to prevent local password authentication.
Where is our data physically stored?
EvalFlow's infrastructure runs on AWS in the United States.
What happens to our data if we cancel?
Upon cancellation, all organization data is permanently deleted from our systems within 60 days, including backups. Contact us if you need a data export before deletion or written confirmation of deletion.
Who at EvalFlow can access our data?
Production database access is restricted to essential personnel and requires elevated authentication. Direct database access is used only for infrastructure maintenance and support operations — never for browsing customer data. All production access is logged.