Security &
Data Governance.
How Flowk safeguards your enterprise conversational infrastructure, protects customer PII, and eliminates AI hallucination risks.
AES-256-GCM Token Encryption
All WhatsApp access tokens, Meta app secrets, Paystack keys, and custom API bearer tokens are encrypted at rest with AES-256-GCM using isolated initialization vectors and cryptographic authentication tags.
Anti-Prompt Injection Guidelines
Every Parlant agent is compiled with persistent anti-leak and anti-injection system guidelines (`sec_anti_leak`, `sec_anti_injection`) to defeat jailbreaks, roleplay impersonation, and prompt disclosure attacks.
Edge IP Ban & Honeypot Traps
Exploitation scanner attempts against vulnerability probes (`/.env`, `/.git`, `/wp-admin`) and hidden honeypot form inputs trigger instant edge-level IP bans with cached 403/404 masking.
2-Session Hard Cost Ceiling
To protect businesses from malicious infinite bot loops or token exhaustion, conversations automatically escalate to human operators at Turn 17+, strictly capping maximum billable exposure at 2 session credits.
Timing-Safe Internal RPC Authentication
Internal microservice communications between Next.js edge and FastAPI core enforce timing-safe HMAC secret comparisons (`crypto.timingSafeEqual`) and 404 camouflage against port scanners.
Human-in-the-Loop Takeover Guarantee
Operators retain full supervisory control. Any live human intervention immediately engages an exclusive mutex lock, silencing the AI agent and transferring 100% of thread ownership instantly.
Privacy Standards & Multi-Tenancy Isolation
Every organization in Flowk operates inside an isolated logical tenant partition. Database records, vector knowledge bases, uploaded PDF assets, and conversational logs are strictly partitioned with row-level tenant validation.
No shared vector contexts or cross-tenant cache bleeding. All knowledge embeddings are strictly keyed by tenant ID.
Inbound customer messages are capped at 2,000 tokens (~8,000 characters) to prevent denial-of-wallet exploits.
Customer conversations and business guidelines are never used to train public foundation models.
Need a custom security review or VPC deployment?
We partner with enterprise compliance and security teams to provide custom DPA agreements, self-hosted Parlant engines, and SOC2 audit reports.