Security
What EaseFlow actually does to protect your account and data, no unverified claims.
Last updated: 5 August 2026
1. Authentication & access
Sign-in is handled by Clerk, a dedicated authentication provider, rather than a custom-built login system. Every non-public page requires a valid session before it loads.
2. Tenant isolation
Your invoices, clients, products, and documents are scoped to your account at the application layer. Every data query is filtered by your user ID before results are returned.
3. Payment security
Card payments are processed by Paystack; EaseFlow never receives or stores your card number. Sensitive subscription events (payment success/failure, plan activation, activation code use) are written to an internal audit log for traceability.
4. Rate limiting
Authentication and other sensitive endpoints are rate-limited to reduce the impact of automated abuse attempts.
5. Transport & browser security
The site is served with a set of standard security headers, including:
- A Content Security Policy restricting which scripts and frames can run
- HTTP Strict Transport Security (HSTS) to enforce HTTPS
X-Content-Type-Options: nosniffX-Frame-Options: DENYandframe-ancestors 'none'to prevent clickjacking- A restrictive
Permissions-Policy(camera, microphone, and geolocation are disabled)
6. Infrastructure
EaseFlow is hosted on Vercel with data stored in Supabase (PostgreSQL). Database backups are managed by Supabase's infrastructure.
7. Ongoing work
Security is an ongoing process, not a one-time checklist. As EaseFlow grows we intend to add further defense-in-depth measures. We won't advertise a control here until it's genuinely in place.
8. Responsible disclosure
If you believe you've found a security issue in EaseFlow, please report it to us directly via WhatsApp rather than disclosing it publicly, so we can investigate and fix it: +234 904 242 7548.