Save 15% on your first order with code WELCOME15Browse modules
Security
Customer data, license keys, payment information. We hold all three. Here's how each is handled.
Card details never touch eTechFlow servers. Payments are processed by Stripe, a PCI-DSS Level 1 provider. The visitor enters their card in Stripe's hosted checkout, and we receive only a tokenised reference, which we store so refunds are possible. We never store the card.
Stripe handles fraud screening and chargebacks, and VAT is calculated and applied automatically at checkout via Stripe Tax.
License keys are HMAC-signed at issue time using per-module secret fragments stored in our environment configuration. Keys validate against a public endpoint; the validation surface is rate-limited (60 req/min per IP, 30 req/min per key) and shape-validated before any HMAC computation.
Customer-facing license operations (rebind, revoke, regenerate) require authentication and are audit-logged.
Customer data lives in a self-hosted PostgreSQL cluster in the UK. Server-side encryption on the disk volume. Database connection over TLS. Daily encrypted backups with a 30-day retention window.
Access to the production database is restricted to a named list of engineers and audit-logged.
Every request to etechflow.com goes over TLS 1.3. HSTS is enforced with a one-year max-age and the preload list. Cookies are SameSite=Lax + Secure on production.
CSP headers limit script execution to first-party + a short list of allowed third parties (Stripe, Resend, PostHog when consented).
Vulnerability disclosure
We welcome reports from good-faith security researchers. Disclose privately by email. We acknowledge within 24 hours and never pursue researchers acting in good faith.
[email protected]For data-subject access / erasure requests under UK GDPR see [email protected] and our Privacy Policy.
