Jobflex LLC (“JobFlex”) builds business software for contractors. This page describes the safeguards we use today. It is part of how we handle information under our Privacy policy.
1. Who can access data
Only the founder has administrative access to JobFlex's production systems: hosting, database, file storage, and source code. No other employee or contractor has that access. Inside the product, each company works in its own workspace and sees only its own records; connecting, disconnecting, and managing an integration such as Ramp requires an owner or manager role in that workspace.
2. Infrastructure and storage
- Hosting: the application runs on Vercel and is served only over HTTPS.
- Database: a managed PostgreSQL database (Neon), reached only over TLS.
- Files: receipts and other private documents are kept in a private Vercel Blob store and served only to the workspace they belong to.
- Passwords: stored only as bcrypt hashes; sign-in attempts are rate-limited.
3. Connected accounts
When you connect a service such as Ramp, Square, Meta, or Gmail, JobFlex receives OAuth tokens rather than your password. Tokens are encrypted at rest with AES-256-GCM before they are stored, under a key held only in our hosting provider's encrypted environment settings and never in source code. Tokens are used only on our servers and are refreshed automatically before they expire.
For Ramp specifically: JobFlex requests only the scopes the integration uses, and does not request access to full card numbers. Events Ramp sends to JobFlex are accepted only after their HMAC-SHA256 signature is verified. When a workspace disconnects Ramp, JobFlex deletes its webhook in Ramp, revokes the access and refresh tokens with Ramp, and deletes the stored connection. Expenses already booked to your jobs stay in your workspace's records.
4. How connected data is used
Data from a connected account is used only to provide that integration's features to the workspace that connected it. We do not sell it or share it with other customers.
5. Certifications
JobFlex is an early-stage company and does not currently hold a SOC 2, ISO 27001, or third-party penetration-test report. We will update this page if that changes.
6. Reporting a security issue
If you believe you have found a vulnerability or that your account has been accessed without permission, email dmitriy@jobflex.app. Please include enough detail to reproduce the issue, and give us a reasonable time to fix it before disclosing it publicly. We will provide security-incident notices when applicable law requires them.