Security
What actually happens to your team’s data, in plain terms — not a policy document written to sound reassuring.
Passwords
Passwords are hashed with bcrypt before they’re ever stored — FlowClock never has your plain-text password. Every new password is also checked against known data breaches using a k-anonymity method: only the first five characters of a hash are ever sent for the check, never the password itself or the full hash.
Transport security
The entire site runs over HTTPS with HSTS enabled, so browsers refuse to fall back to an unencrypted connection. Every page is served with a strict Content-Security-Policy, which limits what scripts and resources are allowed to run at all.
Sessions
Session cookies are set HttpOnly, Secure, and SameSite — they can’t be read by page scripts and are never sent over an unencrypted connection.
Detection & location privacy
FlowClock never uses GPS or location tracking. The mobile app only recognizes your own workplace’s registered FlowClock device, and only while the app is open in the foreground — never in the background. This is disclosed to every employee in the app itself before detection is ever turned on, not just in a policy document.
Data isolation & storage
Every organization’s data — employees, shifts, messages, reports — is scoped to that organization at the database level; there’s no cross-org query path. Data is stored on managed Postgres infrastructure with encryption at rest.
See also the Privacy Policy and Terms of Service. Questions? hello@flowclockhr.com