Fimaflow Security Policy

At Fimaflow, security is a core part of our platform. We are committed to protecting the confidentiality, integrity, and availability of our Services and the data entrusted to us.

This Security Policy outlines the measures we take to secure our infrastructure, applications, and customer information, as well as the shared responsibilities of our users.

Security is a shared responsibility between Fimaflow and our users.

Fimaflow is responsible for:

• Protecting the platform infrastructure.
• Securing hosted services.
• Maintaining application security.
• Monitoring for threats and suspicious activity.
• Applying security updates and patches.
• Protecting customer data stored on our systems.

Users are responsible for:

• Protecting account credentials.
• Managing workspace permissions.
• Reviewing generated code before deployment.
• Securing external services connected to Fimaflow.
• Keeping local devices secure.
• Following security best practices.

We implement multiple layers of security to protect our infrastructure, including:

• Secure cloud hosting.
• Network segmentation.
• Firewalls.
• Continuous infrastructure monitoring.
• Access control policies.
• Encryption of sensitive communications.
• Automated backups where applicable.
• Security logging and auditing.

Infrastructure is regularly maintained and updated to reduce security risks.

We use encryption to protect data during transmission and, where applicable, at rest.

This includes:

• HTTPS/TLS for data in transit.
• Encrypted authentication credentials.
• Secure password hashing using industry-standard algorithms.
• Encrypted communication between platform components where appropriate.

Fimaflow implements authentication and authorization mechanisms designed to protect user accounts.

Security measures may include:

• Secure session management.
• Role-based access controls.
• Workspace-level permissions.
• Account verification where applicable.
• Protection against unauthorized access attempts.

Users should choose strong passwords and avoid sharing account credentials.

Access to the Fimaflow API is protected through authenticated requests.

API users should:

• Keep API keys confidential.
• Rotate credentials when necessary.
• Store secrets securely.
• Avoid exposing credentials in client-side applications or public repositories.

Fimaflow may revoke compromised credentials to protect users and the platform.

AI-powered features are designed to assist software development while maintaining appropriate safeguards.

Users remain responsible for reviewing all AI-generated content before using it in production environments.

Sensitive information should only be provided to AI features when necessary for the requested task.

We continuously monitor our Services to identify:

• Unauthorized access attempts.
• Suspicious authentication activity.
• Infrastructure anomalies.
• Service abuse.
• API misuse.
• Potential security incidents.

Monitoring helps us respond quickly to threats and maintain service reliability.

We work to identify and address security vulnerabilities through:

• Regular software updates.
• Dependency management.
• Security reviews.
• Internal testing.
• Prompt remediation of confirmed vulnerabilities.

Security improvements are deployed as part of our ongoing development process.

If a security incident occurs, we aim to:

1. Detect the incident.
2. Contain affected systems.
3. Investigate the root cause.
4. Mitigate the impact.
5. Restore affected services.
6. Improve protections to reduce the likelihood of similar incidents.

Where required by applicable law, affected users may be notified of significant security incidents.

We encourage responsible disclosure of security vulnerabilities.

If you discover a potential security issue, please report it privately rather than publicly disclosing it.

Please include:

• A description of the vulnerability.
• Steps to reproduce the issue.
• The affected service or feature.
• Supporting screenshots or logs, if available.

Security reports should be sent to:

security@fimaflow.com

We will review reports as promptly as possible and appreciate the efforts of responsible security researchers.

We implement administrative, technical, and organizational measures to help protect customer data.

These measures are designed to reduce the risk of:

• Unauthorized access.
• Accidental disclosure.
• Data alteration.
• Data loss.

Additional information regarding personal data processing is available in our Privacy Policy.

We maintain operational practices intended to support service continuity, including:

• Infrastructure monitoring.
• Redundancy where appropriate.
• Backup procedures.
• Recovery planning.
• Ongoing maintenance and testing.

While no system can guarantee uninterrupted availability, we continuously work to improve platform resilience.

We regularly deploy updates to:

• Improve platform security.
• Address newly identified vulnerabilities.
• Enhance authentication and access controls.
• Strengthen infrastructure protections.
• Improve monitoring capabilities.

Users are encouraged to keep any client software, integrations, or self-hosted components up to date.

Fimaflow continuously works toward maintaining security practices aligned with industry standards and applicable legal requirements.

As the platform evolves, additional compliance certifications or security frameworks may be adopted where appropriate.

We may update this Security Policy periodically to reflect changes in our security practices, infrastructure, or legal obligations.

Material updates will be reflected by revising the “Last updated” date and, where appropriate, notifying users through the Services.

For general security questions:

security@fimaflow.com

To report a vulnerability:

security@fimaflow.com

For legal or compliance inquiries:

legal@fimaflow.com