Security & data handling
How freecashflow.ai stores, isolates and protects your data.
Account isolation
Every resource you create — sessions, models, uploaded data, generated workbooks — belongs to your account. Requests for another account's resources return "not found": the API does not even confirm they exist. Uploaded files are stored under per-account directories.
Authentication
Passwords are stored as bcrypt hashes, never in plain text. Sessions use short-lived access tokens (15 minutes) with rotating refresh tokens that are stored hashed, revocable server-side, and invalidated as a family if a stolen token is ever replayed. Login responses are deliberately neutral, and unknown-email attempts cost the same time as wrong-password attempts, so accounts cannot be enumerated.
Email flows
Verification and password-reset links are single-use tokens, stored hashed, with short lifetimes (24 hours to verify, 1 hour to reset). Requesting a reset for an address reveals nothing about whether it is registered.
Transport & hosting
The public site and the application are served over HTTPS. The production stack runs isolated services (application, worker, PostgreSQL, Redis) behind a reverse proxy, with the database reachable only from inside the stack.
Deletion & retention
Deleting your account revokes access immediately and permanently purges stored files and personal data after a grace window (7 days by default) — a real deletion, not a soft flag. Aggregated usage records (counts, not content) are retained for operating the service; the retention schedule is in the privacy policy.
Waitlist & analytics
The public site sets no cookies and loads no third-party trackers. Site analytics is a first-party counter of page paths and button clicks — no visitor identifiers. Waitlist emails are double-opt-in and used for exactly one launch notification; visitor IPs are kept only as salted, daily-rotating hashes for abuse control.
Not yet in place
There is currently no single sign-on (SSO/SAML), no customer-managed encryption keys, no SOC 2 or ISO 27001 certification, and no two-factor authentication. If any of these is a requirement for you, tell us via the contact page and it will weigh on the roadmap.