Security & Compliance
Flowen is a clinical-grade platform. Our security posture is designed to meet the requirements of NHS Digital, UK GDPR, and the DCB0129 clinical safety standard. This page documents our technical and organisational controls.
Data Protection
AES-256-GCM. All database rows, object storage, and backups are encrypted at rest.
TLS 1.3 minimum. HSTS enforced with 1-year max-age. HTTP Strict Transport Security preloading.
Database encryption keys managed by Supabase (UK data centres). Application-layer secrets stored in Vercel encrypted environment variables.
All personal data stored in UK-GBR data centres. No cross-border transfers without an Article 46 safeguard in place.
Authentication & Access
Supabase Auth with JWT tokens. Email/password and magic link. JWT expiry enforced server-side.
PostgreSQL RLS policies enforce per-user data isolation at the database layer. Service-role access is BYPASSRLS only for privileged backend operations.
Admin routes gated by is_admin flag in profiles table, verified on every request in the proxy layer. Not based on JWT claims alone.
In-process rate limiter in proxy.ts: 60 req/min for /api routes, 120 req/min for all other paths, per IP. Distributed limiting via Upstash Redis planned for multi-region.
Clinical Governance
DCB0129 compliance. Clinical Safety Officer appointed. Hazard Log and Clinical Safety Case Report maintained.
Immutable, append-only consent_audit_log table. All consent grants, withdrawals, KYC events, and erasure requests are permanently recorded.
UK GDPR Article 17 right to erasure. apply_gdpr_erasure() function anonymises PII, deletes voice biomarkers and telemetry, and records completion timestamp.
Raw audio is never persisted. Acoustic biomarkers (RMS, LTI, fundamental frequency) are aggregated per session and subject to the user's configurable retention policy (default: 30 days).
Infrastructure
Vercel (frontend/edge functions). Supabase PostgreSQL (UK data centres). Redis for ephemeral biofeedback state via managed provider.
Vercel edge network provides automatic DDoS mitigation. Cloudflare proxying can be activated for additional L3/L4 protection.
Dependencies audited via npm audit and Dependabot. Critical/high CVEs are patched within 72 hours of disclosure.
Sentry error monitoring with PHI masking (maskAllText, blockAllMedia). No personally-identifying data captured in error payloads. Error logs retained for 90 days.
DCB0129 Clinical Safety
DCB0129 is the NHS Digital Clinical Safety Standard for Health IT. It requires organisations developing clinical health software to:
- ✓Appoint a Clinical Safety Officer with appropriate clinical and technical competence.
- ✓Maintain a Hazard Log identifying clinical risks and mitigation measures.
- ✓Produce a Clinical Safety Case Report demonstrating the system is safe for clinical use.
- ✓Establish a safety management process covering the full system lifecycle.
- ✓Engage with Deployment and Operational Clinical Safety Officers at NHS organisations.
Flowen maintains all four DCB0129 artefacts. NHS commissioners can request our Clinical Safety Case Report and Hazard Log summary by contacting security@flowen.digital.
Responsible Disclosure
If you believe you have found a security vulnerability in Flowen, please report it responsibly. We commit to:
- ✓Acknowledging your report within 48 hours.
- ✓Providing a timeline for investigation and resolution.
- ✓Not pursuing legal action for good-faith security research.
- ✓Crediting researchers in our security acknowledgements (if desired).
Report to: security@flowen.digital with subject line [SECURITY]. Please include steps to reproduce, impact assessment, and any relevant proof of concept.