Security at OnAirFlow

This page describes shipped application controls. It is not a legal conclusion, a universal coverage statement, or an operational SLA.

Account access

• Short-lived access tokens use rotating refresh tokens and support session revocation.
• TOTP two-factor verification is supported for enabled accounts.
• Passwords are hashed with bcrypt.
• Password-change, reset, logout-all, and account-deletion paths revoke applicable sessions and grants.

Organization boundaries

• Organization boundaries are enforced in application queries and on protected database tables.
• Host, producer, and admin roles are enforced through route permissions, with organization-level customization.
• Request schemas validate inputs on protected application routes.
• Account owners can request data export and account deletion. Account deletion requests are processed within 30 days.

Agent access

• Documented agent writes create activity-log entries attributed to the agent user.
• The app uses structured logs, and documented agent writes create attributed activity-log entries.
• Agent users do not count toward the human seat limit.

Route-specific abuse controls

Application limits cover sign-in, 2FA verification, account recovery, refresh, signup, slug checks, marketing/content ingestion, OAuth authorize/register, hosted MCP and API-key probes, most authenticated app route groups, and socket events. Coverage is route-specific, not universal.

Storage options

• Attachments use OnAirFlow-managed storage by default, with Google Drive available as bring-your-own storage.
• Stored Drive tokens, outgoing-webhook secrets, and dormant provider keys use versioned AES-256-GCM encryption in the application.

Responsible disclosure

Report security issues to security@onairflow.com.