Security & Privacy
Flowsta Auth is designed so that no one in between - not even Flowsta - can access your private data.
Security Architecture
| Layer | Protection |
|---|---|
| Authentication | OAuth 2.0 + PKCE, no client secrets, CSRF protection |
| Identity & keys | 24-word BIP39 recovery phrase → HMAC-SHA256 key derivation → Ed25519 keypair, held on your device in Flowsta Vault |
| Private data | Sealed records encrypted on your device - never gossiped to Flowsta or any third party |
| Public data | Identity and Sign It signatures on Flowsta's tamper-proof network, built on Holochain |
| Sessions | Access tokens (24h), SSO session cookie (7d), refresh tokens (30d) |
Core Principles
Zero-Knowledge Privacy
Your keys and private data live on your device in Flowsta Vault, kept per identity: each Flowsta identity on a device has its own folder for its keys, records and app backups. Keys derive from your 24-word recovery phrase; no account password exists on any server, so there is no server-side password to steal, phish, or leak. The only password is the one that unlocks your Vault, and it never leaves your device. Flowsta's server holds an email hash and lookup metadata, the public profile you choose to publish (display name, username, picture), your OAuth consents, and usage counters - see what Flowsta can see. It never holds keys and cannot decrypt anything.
Zero-Knowledge Architecture - Detailed explanation
User-Owned Keys
Every identity is anchored to an Ed25519 keypair derived from a BIP39 recovery phrase via HMAC-SHA256. You own your keys - Flowsta cannot revoke, modify, or access them. Your DID never changes for the life of your identity, and your recovery phrase restores your identity on any device.
No Client Secrets
Flowsta uses PKCE (Proof Key for Code Exchange) instead of client secrets. This is equally secure and works safely in browsers and mobile apps without exposing secrets.
Data Portability
The Export button under Export Data on Flowsta Vault's Your Data page produces a structured JSON export containing your identity, keys, decrypted private records, app data backups, and Sign It signatures. Your data, in a format you can read and take anywhere.
Data Portability - How users access their data
For Developers
- OAuth Security Guide - PKCE implementation, token handling, production checklist
- Sessions - Token lifetimes, refresh flow, revocation
- Backups & CAL Compliance - Meeting CAL license requirements
Next Steps
- Zero-Knowledge Architecture - How device-held keys work
- Data Portability - User data export and restore
- Sessions - Token management
- OAuth Security - Developer security guide