What we collect
FluxLens is built around coordination metadata — timestamps, user IDs, channel names, and issue statuses. Connector payloads are normalized before they are stored, and message body text is never returned to workspace users. We do not read:
- Message content or body text
- File contents or attachments
- Private or direct message content
- Code repositories or source code
Encryption
- In transit
- All data is encrypted with TLS 1.3 during transmission.
- At rest
- Stored data relies on provider-managed encryption controls.
- Secrets
- Integration tokens are encrypted at rest and kept server-side. API keys are stored as hashes, never in a form we can read back.
Access controls
- Authentication
- FluxLens uses authenticated sessions and scoped OAuth connector access.
- Authorization
- Routes that touch customer data re-check the signed-in user’s organization and role before returning or changing anything. Isolation between workspaces is enforced server-side, not in the browser.
- Outbound redaction
- Content is redacted before it leaves the platform — in reports, deliveries, and assistant responses alike.
- Webhooks
- Outbound webhook targets are validated against SSRF before a request is made, and their secrets are encrypted at rest.
What an agent can do
No FluxLens agent acts in your tools unless you authorize it, and no customer has authorized one today.
When you do, an action is proposed before it is taken. The agent produces a dry-run summary of exactly what it intends to change, a person confirms it, and the executed action is written to an audit record with the actor, the organization, and the outcome. An action that is not confirmed does not run.
What we do not have yet
FluxLens is pre-launch. Rather than describe controls as though they were certified, here is where things actually stand:
- SOC 2
- We do not hold SOC 2 Type II certification and do not claim it. Audit evidence is enterprise-readiness work, not a current control.
- Penetration testing
- No independent penetration test has been carried out.
- SSO and MFA enforcement
- Enterprise SSO and enforced MFA are roadmap items. Use MFA through your identity provider in the meantime.
- Data processing agreement
- We do not yet offer a standard DPA. If you need one to evaluate FluxLens, ask and we will work through it with you.
Reporting a vulnerability
If you find a security issue, email support@fluxlensai.com. We will respond and work with you to resolve it. Please give us a chance to address it before disclosing it publicly.