Security
Your code stays yours. So does the decision to ship.
GetFlowing runs delivery work inside your own accounts, keeps a person in front of anything risky, and keeps every customer separate from every other. Security is a requirement of how the platform is built rather than a feature bolted to the side of it.
The short version
Repositories stay in your GitHub account and cloud resources stay under your control. Work arrives as reviewable pull requests. Production deployments, database migrations and secret changes pause for human approval, and the decision is recorded. Every customer is kept separate from every other by the platform itself.
Ownership
Nothing has to leave your accounts.
The safest position for a customer is the one where the platform never becomes a place your software is trapped. GetFlowing is built to work inside what you already own.
True on every plan
- Repositories stay in your own GitHub account. GetFlowing works in them rather than taking custody of them.
- Cloud resources stay under your control, and the applications deployed to them remain yours.
- Work arrives as reviewable pull requests, so nothing reaches your default branch without a human merge.
- Production deployments, database migrations and secret changes pause for human approval.
- Approval decisions are recorded in an audit trail you can read back.
- Deleting an account purges your data.
Your own account
- Two-factor authentication on accounts.
- Session management, so access can be withdrawn immediately.
- Sign-in activity is monitored.
Change control
How a change reaches production.
Each stage leaves evidence behind, so a release can be explained after the fact as easily as it was approved before it.
- 01
Request
The work is described before an agent starts on it, and larger pieces can be agreed in a planning workspace first, so what an agent is about to do is visible in advance.
- 02
Implement
Changes are made on a branch in your repository and opened as a pull request for review.
- 03
Test
The test suite runs on the change and the results are attached to the pull request before anyone merges it.
- 04
Build
The application is built into a container image and checked before it is eligible to be released.
- 05
Approve
Production deployments, migrations and secret changes wait for a person, with an explanation of what will happen.
- 06
Deploy and record
Health checks gate production traffic, and the release and its approval are written to the audit trail.
Security questions
Questions buyers and reviewers ask
Ownership, approvals, separation between customers, and what happens when you leave.
Which actions pause for a human approval?
Production deployments, database migrations and secret changes. Each one waits in an approvals queue with an explanation of what will happen, and the decision is recorded in an audit trail you can read back.
How are secrets handled?
Secrets are encrypted at rest and are never exposed in the application code, the repository or the pull request. Changing one counts as a risky action, so it waits for the same human approval a production deployment does.
What can I do to protect my own account?
Turn on two-factor authentication, keep the number of people with access to what you actually need, and review your active sessions from time to time, ending any you do not recognise. Sign-in activity is monitored on our side as well.
What happens to my data if I close my account?
Deleting an account purges your data. Your repositories are unaffected, because they were never moved: they stay in your own GitHub account throughout, as do the cloud resources under your control.
Something not covered here? Email hello@getflowing.ai and we will answer directly.
Private beta
Bring software delivery into one system.
Build something new or take control of what already exists. Get the planning, engineering, deployment, and operational capability of an experienced software team.