Public websites
abdflow.com and the product sites ABDflow publishes. These run over HTTPS, with access limited to the people who operate them.
Security
Protection that matches the work.
ABDflow.com protects its public websites and designs access, encryption and review into customer software. This page says what is in place today, and what is only agreed in a specific project.
What this page covers.
Customer projects
Software built or configured for a customer. The controls for that system are written into the project agreement, not assumed from this page.
What is not a certificate
ABDflow.com has not published a SOC 2 report or an ISO 27001 certificate. Those marks are not claimed here.
Public sites.
Encrypted connections
Pages are served over HTTPS. Browsers that support modern TLS negotiate that connection with the hosting provider.
Hosting
The public sites are hosted on Vercel. Application data used by ABDflow products in this account is stored with Supabase. Each provider keeps its own security programme.
Access to our accounts
Production hosting, domain and database accounts are limited to the people who operate ABDflow.com. Shared passwords are not the intended way to run those accounts.
Site measurement
First-party analytics records pages, device type and an approximate location from the IP address. Details are in the privacy notice and the cookie page.
Content security
Public pages set a content security policy so the browser only loads scripts and connections the site expects.
Dependencies
Site code is deployed from the project we maintain. A vulnerability in a dependency is handled as a fix, not left as a public claim that every library is audited.
Customer software.
When ABDflow designs a system, these are the controls that are discussed and then written into scope. They are not automatically present in every demo.
Roles and permissions
Access follows the job. A person sees the records their role needs, and administrative actions stay with named owners.
Sign-in
Accounts use a password or the identity method agreed for that project. Extra sign-in checks, such as a second factor or a company identity provider, are added when the customer requires them.
Records of activity
Important actions can be logged: who changed a record, when, and from which account. How long those logs are kept is part of the agreement.
Separation of environments
Demonstration data is not customer production data. A live system is not used as a sandbox for experiments.
Backups
Where the project includes hosted data, backup and restore expectations are agreed before go-live. A public page cannot promise a recovery time for every customer.
AI features
MAK.U and similar assists work inside the permissions of the workflow. Customer production records are not used to train a public model. A person reviews consequential output.
Where information sits.
ABDflow.com is registered in Ernakulam, Kerala, India. Personal information from the public sites is handled by that business. Hosting and database providers may process it in the countries where they operate, including outside India.
A customer project can ask for a specific hosting region. That choice is confirmed in the agreement. It is not a promise that every ABDflow demo already runs in the customer’s country. Customers in the UAE or the UK are still contracting with ABDflow.com in Kerala unless the contract names another party.
More on personal information: privacy notice. More on what is and is not a certification: compliance.
Report a vulnerability.
If you find a weakness in an ABDflow website or product, email support@abdflow.com or connect@abdflow.com. Please include the address, what you did, and what you observed. Give us a reasonable time to investigate before publishing details.
A machine-readable contact file is published at /.well-known/security.txt. Do not use a vulnerability report to access another customer’s data, to disrupt the service, or to demand payment.
In scope
abdflow.com and the ABDflow product sites we operate. A customer’s own deployment is in scope only when that customer asks us to receive the report.
Out of scope
Social engineering of staff, physical attacks, denial-of-service, and issues in third-party services we do not control.
What you can expect
We will acknowledge a clear report and work on a fix when we can reproduce it. We do not publish a bounty or a guaranteed response time.
If something goes wrong.
If we learn of unauthorised access to personal information on a system we operate, we will investigate, contain what we can, and tell the affected people and any authority the law requires. The timing depends on what happened and on the law that applies. It is not a fixed clock advertised in advance.
For a customer-hosted or customer-controlled system, the agreement says who leads the response. ABDflow.com will help with the parts it operates.
What stays with you.
Accounts
Choose strong sign-in details, remove people who leave, and do not share administrative logins.
Your rules
Tax, employment, licensing and sector rules in India, the UAE or the UK stay with your organisation and your advisers. Software does not replace that duty.
What you upload
Do not put secrets or customer records into a public demo. Use the project environment agreed for that data.
Security questions: support@abdflow.com. Project questions: connect@abdflow.com. Registration: ABDflow.com, Ernakulam, Kerala.