> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluso.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How Fluso is built to protect your data. Encryption, authentication, infrastructure isolation, and how to report a vulnerability.

This page is about the infrastructure side: how data is encrypted, how authentication works, how user environments are isolated, and how to report a problem. For the data side — what's collected, what isn't, and your rights — see [Privacy](/resources/privacy).

## Encryption

| Data                           | Protection                               |
| ------------------------------ | ---------------------------------------- |
| In transit                     | TLS 1.2+ on every connection             |
| Workspace files                | Encrypted at rest (AES-256)              |
| Database                       | Encrypted at rest                        |
| OAuth tokens                   | Encrypted in a dedicated secrets manager |
| Conversations and chat history | Encrypted at rest                        |

OAuth tokens never appear in environment variables, logs, or anywhere outside the secrets manager.

## Authentication

**User auth runs through Clerk.** Passwords, multi-factor authentication, and social login. Fluso doesn't see or store user passwords directly.

**Connected apps use OAuth2.** When you connect Gmail, Calendar, Slack, or GitHub, Fluso never sees those passwords either. Tokens are scoped to exactly the permissions you approved on the OAuth screen.

**Per-user isolation.** One user's credentials cannot access another user's data. Tokens, files, conversations, and the knowledge graph are scoped to the authenticated user.

## Infrastructure

**Sandbox containers.** Each user gets a dedicated container. Network policies prevent cross-user communication.

**Token refresh.** OAuth tokens are refreshed automatically before expiry. Failed refreshes show as a "Reconnect" prompt in Customization → Connectors instead of silent denial.

**Secret delivery.** Credentials reach containers via secure boot files, not environment variables. They cannot be enumerated by reading process state.

**Audit logging.** Administrative actions (account creation, OAuth grants, deletions) are logged. The content of your work is not.

## Account security

A few things to do, regardless of plan:

**Enable multi-factor authentication.** In Clerk's account settings. Fluso doesn't enforce it by default, but it's the single biggest improvement to account security and takes a minute.

**Review connected apps monthly.** Customization → Connectors. Disconnect anything you've stopped using. Fewer connected apps means a smaller attack surface and a more focused knowledge graph.

**Watch for phishing.** Fluso will never ask for your password by chat or email. Genuine support requests come from `@premai.io`. If something looks off, [email security](mailto:security@premai.io) directly to verify.

**Report devices you don't recognise.** Clerk's session list shows active sessions. End any you don't recognise.

## What Fluso never does

The hard rules, encoded in the product itself:

* Delete your emails or files.
* Change your account settings on connected apps.
* Take write actions on connected apps without your approval.
* Share your data with third parties.
* Train models on your private data.
* Access apps you haven't connected.

Most of these are technical impossibilities given the OAuth scopes Fluso requests. Some are policy commitments. All are tested.

## Compliance

For Enterprise customers, Fluso supports custom data residency, SSO (SAML/OIDC), audit logging, SLA-backed availability, and a Data Processing Agreement. SOC 2 Type II audit is in progress.

[Contact us](mailto:sales@premai.io) for the security questionnaire and detailed compliance documentation.

## Reporting a vulnerability

Found something? [security@premai.io](mailto:security@premai.io). We respond within 24 hours.

Coordinated disclosure is appreciated. We'll acknowledge receipt, work on a fix, and credit you publicly if you'd like.

<Warning>
  Don't share your account credentials with anyone, including teammates. If a teammate needs access, invite them through your Team plan instead. Fluso staff will never ask for your password.
</Warning>