Security and controlled access
Last updated:
Workspace access
SOPFlow checks organization scope and permissions on the server. Roles, capabilities, and team assignments determine access to procedures and administrative actions. Review membership and shared links when responsibilities change.
Authentication
Password authentication uses stored password hashes. Email verification and new-device verification protect the sign-in flow. Expiring verification tokens, rate limits, and trusted-device controls support account security. Workspace identity settings determine the available sign-in options.
Files, recordings, and public sharing
Private files and recorder screenshots are served through access-controlled routes. Authorized users can intentionally share selected content through managed links or a help center. Review visibility, link expiry, password settings, and portal indexing before publishing information.
Drafts, reviews, and evidence
Procedure versions and review decisions help teams identify the instructions they approved. Audit events record actors and actions for supported operations. Training sessions and runs retain procedure context for their records. These features support review; they do not establish that every procedure is technically correct.
Recorder and AI data
Record with example data whenever possible. Input masking is not a guarantee that screenshots or page content contain no sensitive information. Review captures before sharing. AI features process selected content through configured providers; see the privacy policy for the relevant data categories.
Transport and operational controls
Use the HTTPS service and keep access credentials private. Security requirements can depend on the deployment, contract, and feature configuration. Contact us for current information about hosting, backups, encryption requirements, and the controls your organization needs to evaluate.
Compliance and procurement
Product features do not confer ISO certification, establish HIPAA eligibility, or guarantee an audit outcome. Ask for current evidence and applicable agreements when reviewing certification, data residency, retention, or regulated-data requirements.
Report a security issue
Send a private report to admin@sopflow.io with the affected page, a description, and reproducible steps that do not expose another person’s data. Do not include passwords or access tokens. The security.txt record below provides the published contact details.