Security & Vulnerability Disclosure

Reporting a vulnerability

If you believe you have found a security vulnerability in AcqFlo, please email security@acqflo.com with the subject line “Security: [brief description].” We acknowledge reports promptly and prioritize confirmed issues by severity.

Please include enough detail to reproduce the issue: a description of the vulnerability, the affected URL or endpoint, steps to reproduce, and the impact you observed. If you have a proof-of-concept, attach it.

How we protect your data

AcqFlo runs on infrastructure certified to SOC 2 Type II (Supabase, Vercel). AcqFlo is not itself SOC 2 certified. Our current controls include:

• Tenant isolation. Each organization’s data is separated at the database level with PostgreSQL Row-Level Security, enforced on every query rather than in application code alone.
• Encryption. All traffic is served over TLS with HSTS. Data is encrypted at rest, and sensitive secrets such as API keys and OAuth tokens are additionally encrypted with AES-256-GCM. API tokens are stored only as one-way hashes.
• Access control. Every request is authorized against the caller’s organization membership over an authenticated session, with role-based permissions enforced in the web application.
• File storage. Documents are held in private, per-organization storage and served through short-lived signed URLs, or kept in your own OneDrive or SharePoint tenant if you connect one.
• Hardening. A strict Content-Security-Policy and full security-header set, tiered rate limiting (authentication limits fail closed), and automated secret scanning on every commit.
• Monitoring & audit. Errors are monitored with personal data scrubbed before it leaves our systems, and stage and transaction changes are written to append-only audit trails.

For security reviewers

If you are evaluating AcqFlo on behalf of your organization, we maintain a written vendor security assessment covering tenant isolation, data residency, our full subprocessor list, encryption, retention and deletion, incident response and breach-notification timelines, business continuity, and a candid accounting of the controls we do not yet have. It answers most standard questionnaires directly. Email security@acqflo.com and we will send it, along with our incident response plan.

We would rather answer these questions once, in writing and up front, than discover a blocker late in your review.

Scope

The following are in scope:

• The AcqFlo application at acqflo.com
• The AcqFlo API and Outlook Add-in
• Authentication, authorization, and tenant-isolation issues

The following are out of scope:

• Denial-of-service or volumetric attacks
• Social engineering of AcqFlo employees or customers
• Physical attacks against infrastructure providers
• Issues in third-party services (Supabase, Vercel, Microsoft, Anthropic); please report those directly to the respective vendor
• Findings from automated scanners without a working proof of concept
• Missing security headers without demonstrated impact

Safe harbor

We will not pursue legal action against researchers who report vulnerabilities in good faith and follow this policy. Specifically, we ask that you:

• Do not access, modify, or delete data belonging to other customers
• Do not disrupt service availability
• Use only test accounts you own to reproduce issues
• Give us a reasonable opportunity to fix the issue before public disclosure
• Do not extort, threaten, or demand payment in exchange for disclosure

Disclosure timeline

We aim to acknowledge reports within 2 business days, triage within 5 business days, and resolve critical or high-severity issues within 30 days. We will keep you informed of progress and notify you when the issue is resolved. We support coordinated disclosure and welcome public write-ups once a fix is released.

Recognition

AcqFlo does not currently operate a paid bug bounty program. With your permission, we are happy to acknowledge your contribution publicly when a fix is released.

Machine-readable contact

Our security.txt file follows RFC 9116.

Contact

security@acqflo.com