Security and privacy are core priorities for our platform. We operate our service using industry-standard security practices and continuously improve our controls as the platform evolves. Our infrastructure, development processes, and operational procedures are designed to protect customer data and ensure reliable service.
Compliance & Governance
Aligned with recognized industry frameworks
Our security program is guided by established frameworks and security best practices recommended by AWS. These frameworks guide the design of our policies, procedures, and operational controls.
Cloudflare — Our First Line of Defense
Global edge protection against DDoS, bots, and malicious traffic
Every request to the FLEX platform first passes through Cloudflare's global edge network before it ever reaches our application servers. Cloudflare operates one of the largest networks in the world, with the capacity and intelligence to absorb and filter attacks at the edge — protecting our infrastructure from volumetric DDoS attacks, malicious bots, credential stuffing, and known exploit attempts before they ever touch our origin.
Traffic is filtered close to its source, not at our origin
Capacity to absorb the largest recorded attacks on the internet
Cloudflare blocks billions of malicious requests across its network every day
Every request is scored for bot likelihood and threat reputation
Defense in Depth: Cloudflare is the outermost layer of our security model. Even if a request makes it past the edge, it must still pass our AWS network controls, application-level authorization, and tenant isolation checks before reaching any data.
Cloud Infrastructure Security
Hosted on Amazon Web Services with enterprise-grade protections
Our platform is hosted on Amazon Web Services (AWS), a leading cloud provider with extensive physical and infrastructure security controls. Customer data is stored in AWS cloud infrastructure in controlled environments with strong access controls and encryption.
Data Protection
Multiple layers of security controls
- Encryption in Transit TLS
- Encryption at Rest AES-256
- Encryption keys held and maintained by Webauthor
- Least-privilege access policies
- Role-based access controls
- Periodic access reviews
- Secure credential management
Data Ownership: Customers retain ownership of their data. Customer data is only used to provide the service and is not sold or shared outside the platform. AWS does not have access to client data; it is encrypted with keys held by Webauthor.
Application Security
Integrated into development and deployment
- Version-controlled source code repositories
- Code review before deployment
- Controlled deployment processes
- Dependency vulnerability scanning
- Regular patching and updates
- Web application firewall (WAF)
- DDoS protection & intrusion prevention
Pen Testing: Regular penetration testing and internal/external vulnerability and security testing programs are maintained to continuously validate defenses.
Monitoring & Operations
Detect and respond to potential security issues
- Infrastructure & application logging
- Security alerting & operational monitoring
- Controlled administrative access
- Incident response procedures
- Vulnerability monitoring & remediation
- Periodic independent penetration testing
Backup & Recovery
Service continuity and data resilience
Full-machine images created weekly and on major changes
Daily full backups + incremental every 5 minutes
- All backups encrypted in transit and at rest
- Stored separately from production data
- 7-year retention policy
- Quarterly recovery simulation/testing
Shared Responsibility Security Model
Understanding security responsibilities across all layers
The FLEX platform operates under a shared security responsibility model. With cloud-hosted applications, it is critical to understand which security tasks are handled by the cloud provider, by the software/service provider, by the implementation team, and by the client.
Amazon Web Services — Security of the Cloud
AWS provides the underlying infrastructure and services that FLEX is built on, including physical security of data centers, highly available compute, network, storage, and database systems.
- Physical security protection of data center infrastructure
- Highly available compute, network, storage, and database systems
- Security of proprietary management platforms and provisioning systems
- AWS does not have access to client data — encrypted with keys held by Webauthor
Implementation — Configuration Security
Webauthor configures and customizes the FLEX platform for each client, implementing client-specified security and privacy requirements, and providing training and support.
- Client-specific security and privacy configuration
- Identity management, access control, and data governance options
- Secure data transfer protocols (file upload & API integration)
- Security best practices for client connections and data in transit
Client — Data Security
Clients are responsible for the security of their specific FLEX instance, including areas that Webauthor cannot control:
- Identification & Authentication — Passwords, MFA, credential handling; SSO integration (Azure AD, Google, Okta, etc.)
- Access Controls — Permissions structure and access control matrix
- Data Handling — Role-based rules including IP restrictions, geo-IP blocking, and data access procedures
- Data Privacy — Informing the implementation team of specific privacy requirements
- Incident Response — Maintaining an incident response program and meeting regulatory notification requirements
- Endpoint Security — Patching, antivirus/EDR software, and device encryption
Tenant Isolation
Logical separation for every customer
Responsible AI Use
How FLEX uses AI — and how we protect your data when it does
AI is a powerful capability inside FLEX, but it is used deliberately and in two clearly defined ways. In both cases, we have designed the integration so that personal and sensitive data is protected, is never used to train third-party models, and is never exposed outside of agreements that govern its handling.
1. Metadata-Only Queries — Structured Q&A
When users ask AI to answer a question about their data, we do not send the underlying personal or sensitive data to the AI model. Instead, we send only metadata that describes the shape of the data:
- Database schema (table and column names, relationships)
- System configuration and setup
- Form definitions — field names, labels, hints, and option lists
- Available filters, dimensions, and report definitions
The AI returns a structured query that we then execute against our own database inside our secure environment. The actual records, names, contact information, and any other personal or sensitive content stay entirely within FLEX. The AI sees only the question and the map of where to look — never the data itself.
The bottom line: For day-to-day AI features, your data simply isn't sent to the AI at all — only metadata is. When AI must see real data, it is processed inside a BAA-covered, enterprise-grade environment where the data is not retained, not used for training, and not exposed.
Compliance Roadmap
Continuous maturity as the platform and customer base grow
Have Security Questions?
Security is an ongoing process. As our platform and customer base grow, we continue to enhance our security program. Contact our team for additional information or to discuss your specific requirements.
Get in Touch
Sales & Partnerships
+1 888-288-2294
sales@webauthor.com
Technical Support
24/7 Support Available
support@webauthor.com
Security Practices
Key Highlights
Webauthor: Security & Privacy by Design
© 2025 Webauthor Corporation. Maintaining a reliable, secure, and trustworthy platform for all customers.