Security Policy

1. Purpose

This Security Policy describes the technical and organizational measures Universal Workflow applies to protect Customer Data.

2. Encryption

Data in transit is encrypted using TLS. Data at rest is encrypted at the infrastructure level by our database and hosting providers. Passwords are hashed, never stored in plaintext.

3. Access Controls

• Row-Level Security (RLS) policies restrict every database query to the authenticated user's own company.
• Authentication is cloud-authoritative, verified against the backend each session.
• Logout clears in-memory data to prevent residual exposure on shared devices.
• Administrative access to production systems is restricted to authorized personnel.

4. Payment Security

UWF does not store full card numbers. All card data is handled directly by Stripe, a PCI-DSS Level 1 certified processor.

5. Backups and Continuity

Application data is stored in a managed PostgreSQL database with automated backup capabilities. Customers can export their own data at any time.

6. Incident Response

Suspected security incidents are triaged promptly, with containment as the first priority, followed by root-cause analysis, remediation, and notification consistent with our DPA.

7. Reporting a Concern

Report suspected vulnerabilities to security@universal-workflow.com.

This is a condensed summary. The complete Security Policy is available on request or at our website.

Also see: Privacy Policy · Terms and Conditions. Questions: contact us.