Security Policy

1. Cryptographic Controls & Data Encryption

All sensitive customer data, API keys, database records, and authentication tokens processed by Flowwithlit are encrypted at rest using AES-256-GCM symmetric key encryption. In-transit communication across user applications, merchant checkout widgets, and internal banking microservices is enforced over HTTPS utilizing mandatory TLS 1.3 encryption protocols.

2. Infrastructure Resilience & Access Controls

Flowwithlit infrastructure operates on isolated Virtual Private Cloud (VPC) environments with zero direct public access to database servers. Application access is strictly governed by the Principle of Least Privilege (PoLP) and identity-based access management (IAM) requiring mandatory hardware multi-factor authentication (MFA).

3. Digital Asset & Treasury Custody Architecture

Digital asset reserves handled by Flowwithlit utilize multi-signature threshold cryptography (MPC/Multi-Sig). Over 95% of asset liquidity is stored in air-gapped, distributed cold custody solutions. Hot wallet operational funds are governed by automated algorithmic limits to mitigate exposure to zero-day external threats.

4. Application Security & Continuous Auditing

Our core payment engine, webhooks, and REST APIs undergo continuous vulnerability scanning, static application security testing (SAST), and independent third-party penetration testing. Automated Web Application Firewalls (WAF) actively block Distributed Denial of Service (DDoS) attempts, SQL injection, cross-site scripting (XSS), and automated credential stuffing.

5. Responsible Vulnerability Disclosure Program

Flowwithlit values the security research community. If you discover a security flaw, vulnerability, or potential exploit in our systems, we encourage you to report it responsibly. Please email detailed steps to reproduce to security@flowwithlit.com.

• Do not access or attempt to access another user's account or personal data.
• Do not execute Denial of Service (DoS/DDoS) attacks against our infrastructure.
• Allow our engineering team a minimum of 14 business days to patch verified flaws before public disclosure.

6. Incident Response & Breach Notification

Flowwithlit maintains an active 24/7 Security Operations Center (SOC). In the event of a verified security incident affecting customer data, Flowwithlit will notify impacted users and regulatory authorities within 72 hours in full compliance with statutory data privacy mandates.