LisFlow · Legal
Security
August 21, 2026 · Version 1.0
Security overview for launch preparation. Replace planned controls with verified controls before making compliance claims.
LisFlow is designed with separated provider adapters, server-only secrets and durable workspace storage.
Platform controls
API keys are read only on the server. Inputs are validated, provider boundaries are explicit and operational errors can be monitored without displaying secrets.
Access and resilience
Protected tools use confirmed Supabase email identity or verified ChatGPT identity, short-lived opaque LisFlow sessions, server-side ownership checks and administrator authorization. Billing webhooks are handled server-side. Backups, monitoring and an incident process must be finalized before broad public launch.
Shared responsibility and reports
Workspace owners must protect credentials and marketplace permissions. Security concerns should be sent to the configured support address with steps to reproduce and no unnecessary sensitive data.