How we keep your data safe
The plain facts about how FlockCentral protects your organization and the people who register with you.
Passwords are hashed
Your team’s passwords are stored as argon2id hashes, never in a readable form. We cannot see them, and neither can anyone who reads the database.
A code by text on every login
Every admin login takes the password and a one-time code sent to the person’s phone. A browser can be trusted for 30 days so the code isn’t asked for each time; the password always is.
Sessions stay on one site address
A login belongs to the address it was made on. Each organization runs on its own address, and a session on one is never sent to another. Session cookies are unreadable to page scripts and only travel over HTTPS.
Card numbers never touch FlockCentral
People pay on Stripe’s own checkout page, and a card your team types in goes from the browser straight to Stripe. The number is never sent to our servers or stored by us.
Each organization’s data is kept apart
Every request is checked for who is asking and which organization they belong to before it reaches any data. Your team sees your organization’s events and registrations, and no one else’s.
Your data is never sold
We don’t sell personal information, and we don’t use it to advertise to anyone. There are no advertising or tracking cookies. The people who register with you are your organization’s, not ours.
HTTPS everywhere
Every connection to FlockCentral is encrypted, through Cloudflare. The servers accept no plain HTTP, and only Cloudflare can reach them.
Hosted in the United States
FlockCentral’s servers and database are in the United States; the services named in our Privacy Policy process data where they run.
Expired codes are cleaned up nightly
Login codes and password-reset links expire quickly and are deleted every night once they have. Old sessions and expired trusted-browser records go the same way.
Report a security issue
Found something that worries you? Email [email protected] and we will look at it promptly. Our Privacy Policy says what we collect and who else handles it.