Security Overview — founder-review draft

FLONOVI uses authenticated workspaces, membership-backed database protection, server-side authorisation, private public-form keys, bounded public submissions and approval paths.

Provider-token storage fails closed in production until a production vault is selected. No certification, penetration-test result or regulatory approval is claimed.

Production vault selection, webhook verification per provider, monitoring, incident contacts, key rotation, backup testing and an independent security review remain required.