Security & Privacy
Flowsta Auth is designed so that no one in between - not even Flowsta - can access your private data.
Security Architecture
| Layer | Protection |
|---|---|
| Authentication | OAuth 2.0 + PKCE, no client secrets, CSRF protection |
| Identity & keys | 24-word BIP39 recovery phrase → HMAC-SHA256 key derivation → Ed25519 keypair, held on your device in Flowsta Vault |
| Private data | Sealed records encrypted on your device - never gossiped to Flowsta or anyone else |
| Public data | Identity and Sign It signatures on Flowsta's tamper-proof network, built on Holochain |
| Sessions | Access tokens (24h), SSO session cookie (7d), refresh tokens (30d) |
Core Principles
Zero-Knowledge Privacy
Your keys and private data live on your device in Flowsta Vault. Keys derive from your 24-word recovery phrase - there is no password, so there is no password to steal, phish, or leak. Flowsta's server stores only an email hash and lookup metadata: it never holds a password hash, never holds keys, and cannot decrypt anything.
Zero-Knowledge Architecture - Detailed explanation
User-Owned Keys
Every identity is anchored to an Ed25519 keypair derived from a BIP39 recovery phrase via HMAC-SHA256. You own your keys - Flowsta cannot revoke, modify, or access them. Your DID never changes for the life of your account, and your recovery phrase restores your identity on any device.
No Client Secrets
Flowsta uses PKCE (Proof Key for Code Exchange) instead of client secrets. This is equally secure and works safely in browsers and mobile apps without exposing secrets.
Data Portability
Flowsta Vault's Your Data page provides "Download All Data" - a structured JSON export containing your identity, keys, decrypted private records, app data backups, and Sign It signatures. Your data, in a format you can read and take anywhere.
Data Portability - How users access their data
For Developers
- OAuth Security Guide - PKCE implementation, token handling, production checklist
- Sessions - Token lifetimes, refresh flow, revocation
- Backups & CAL Compliance - Meeting CAL license requirements
Next Steps
- Zero-Knowledge Architecture - How device-held keys work
- Data Portability - User data export and restore
- Sessions - Token management
- OAuth Security - Developer security guide