Security

Encryption

At rest: disk-level encryption is configured on production hosts. Backups are encrypted in transit; at-rest encryption for backups is provided by the storage provider (Tigris/S3).

In transit: all dashboard and API traffic is served over TLS with certificates issued by Let's Encrypt. Postgres endpoints at *.db.flickercloud.com accept TLS; sslmode=require is the documented default.

Tenant isolation

Tenant isolation is enforced through Postgres roles, per-database schemas, and per-database filesystem datasets. Isolation has not been independently audited; we encourage customers to report any cross-tenant exposure to security@flickercloud.com.

Memory search and graph traversal are scoped to your organization at every hop, not only at the record you started from. Each neighbour is re-loaded under your organization and dropped if it does not belong to it, so an edge alone cannot surface a record you may not read. A record that belongs to another organization and a record that never existed return the same answer, so existence is not probeable.

AI features and your content

Content retrieved from your project — ticket bodies, documents, notes — is treated as data, never as instruction. A document containing text addressed to the assistant does not change what it does.

The tools the assistant can call are read-only and take no organization argument: the organization comes from your session, and any organization-like value appearing in a tool call is discarded before the call runs. This is enforced by the shape of the tool interface rather than by instructions in a prompt, because a prompt is exactly what retrieved content could try to override.

Backups and point-in-time recovery

Per-database backups run through CloudNativePG — continuous WAL archiving to object storage plus periodic volume snapshots — with an automated weekly restore drill. Point-in-time recovery (PITR) availability and retention windows are best-effort and may vary by database; no RTO/RPO commitment during beta.

Separately, a daily logical dump (pg_dump) of each database is taken inside the cluster and written to object storage. It is a distinct guarantee, not a duplicate: a physical backup copies data files and so copies corruption faithfully, while a logical dump reads every row back through the SQL layer and restores into any comparable PostgreSQL. Restore of a logical dump is currently a manual procedure — it is not yet covered by the automated restore drill.

Deleted customer data is purged from primary storage within 30 days; backup catalogs may retain data longer per backup retention policy.

Authentication and access

The dashboard uses email and password authentication with bcrypt password hashing. Signup is invitation-only and invitations are scoped to a single organization. API keys are issued per organization and stored hashed. Personal CLI tokens are issued per organization to one member, stored hashed, revocable from Account Settings, and limited by the server to identity and agent-config routes — they cannot deploy, read secrets, or reach a database. We do not yet offer SSO or hardware-key MFA; both are on the roadmap.

Subprocessors

The vendors below process customer data or operational metadata on our behalf. We will give reasonable advance notice before adding a new subprocessor that touches customer data.

Data residency

Customer databases and backups are hosted in the United States, specifically the OVH Vint Hill, Virginia data center. We do not currently offer EU or other regional residency; that's planned for after Phase 1.

Penetration testing and audits

We have not yet engaged a third party for a formal penetration test. An external pen test is planned for after Phase 1. We do not hold SOC 2 or ISO 27001 attestations at this time.

Vulnerability disclosure

If you believe you have found a security vulnerability in Flicker, please email security@flickercloud.com with details and, where possible, steps to reproduce. We commit to:

• Acknowledging your report within 3 business days.
• Keeping you informed as we investigate and remediate.
• Coordinating public disclosure within 90 days of the report, sooner if the issue is already public or actively exploited.
• We will not pursue legal action against good-faith researchers who follow the disclosure terms below, to the extent permitted by applicable law. Good faith means: no data exfiltration beyond proof-of-concept, no service degradation, no access to other customers' data, and reasonable disclosure timelines.

Incident response

Security incidents are triaged by our on-call operator. We will notify affected customers without undue delay after becoming aware of a confirmed personal data breach, and in any event consistent with applicable law. See our Data Processing Addendum for more. For general security inquiries, contact security@flickercloud.com.