SETROASFLOW — SECURITY OVERVIEW

Version: Draft — 25 August 2026

SetRoasFlow uses a server-side architecture on Cloudflare Workers with managed data services.

Current safeguards include:

• TLS in transit.

• HMAC verification for supported webhooks.

• Constant-time signature comparison.

• Signed OAuth state.

• HMAC-SHA256 signed cookies.

• Secure and HttpOnly master cookie.

• Server-side secret management.

• Server-side storage and use of merchant credentials.

• SHA-256 identity hashing before advertising egress.

• Backend-only service-role database access.

• Token-protected internal APIs.

• PII truncation/redaction in log previews.

Administrative access:

Authorized SetRoasFlow personnel may have technically possible administrative access to production data stores when necessary for operations, maintenance, debugging or support. This access is governed by organizational and contractual restrictions. No claim is made that customer data is technically inaccessible to the operator.

Recovery:

Cloudflare D1 currently provides point-in-time recovery with up to 30 days of retention on the applicable paid Workers configuration. Durable Objects recovery is expected to be approximately 30 days, subject to technical verification. Cloudflare KV has no backup copy. Supabase currently operates on a Free configuration without automatic backups; a future Pro configuration may use daily backups retained for up to 7 days.

SetRoasFlow does not currently claim SOC 2, ISO 27001 or other security certification.

[ENGINEERING REVIEW REQUIRED: add only verified backup, monitoring, vulnerability-management, incident-response and disaster-recovery controls.]