Security, sessions and settings
What is kept, who can read it, and which settings never leave this browser.
Open in Flowra/settings/profile/passwordAccount security
SessionA server-side cookieExpiry30 daysApp lockOn, this browser onlyThe audit trailOperator reads onlyChanging a password drops the live sessions.
What this is wired to
Sessions and signing out
The authority is a server-side session behind a cookie the page script cannot read. The copy kept in the browser is only for rendering: a name, a role, and routing.
Signing out reaches the server, because clearing only the browser copy would leave the cookie valid. And any «not allowed» answer from an ordinary route drops the stale copy and sends you to the login page, once.
Sessions expire after thirty days, and changing a password or freezing an account drops that user's live sessions.
What stays in this browser only
Theme, calendar, pinned tools and app lock are saved in this browser and don't go to the server. That means you have to choose them again on another device, and clearing site data erases them. Language is the exception: it's saved on your account and is the same on any device you sign in on.
The audit trail
Reading it is for the operator alone, because it spans the whole system: who revealed which card's details. Writing to it is open to any signed-in user, but only for whitelisted actions and always as themselves.
Signing up in two steps
The first step validates the form and mails a six-digit code; the second is what creates the account. Between them the account-to-be waits with its password already hashed, so a half-finished sign-up is never a half-made user.
Everything the first step checked is checked again at the second, because minutes pass between them: sign-up can be closed, and the username can be taken.
Bounding failed attempts
Counting happens in the database rather than in memory, so it holds across instances and restarts. Two scopes with different thresholds: a username locks sooner and an IP later, because an IP is often a whole office behind NAT.
Sign in with username or email
On the sign-in page, you enter your account's username or email and your password. Passwords are hashed with bcrypt and never stored as they are. If Caps Lock is on, a note appears below the password box.
Every sign-in error gets the same message, “Username or password is incorrect”, so nobody can tell from the reply which account exists. After eight failed attempts on one username, or forty from one IP address, sign-in is closed for fifteen minutes. An account deactivated by the super admin can't sign in at all.
Forgot password
“Forgot your password?” takes a username or email and sends a six-digit code to that account's email. The reply is always the same, whether the account exists or not, so this form never leaks a list of accounts. The code is valid for ten minutes, works once, and stops working after five wrong guesses.
Once the password is changed, every earlier session of that account is closed, a “your password was changed” email arrives with a “This wasn't me” link, and you're signed in right there. The new password is at least eight characters, and any character is allowed.
- On the sign-in page, tap “Forgot your password?”
- Enter your username or email and tap “Send reset code”
- Enter the emailed code and your new password
- “Change password and sign in” closes every other session and signs you in
Change password
In “Account and security” in settings, “Change password” first asks for your current password, then the new one twice. This page also accepts a four-character password, but a longer one is always safer; sign-up and recovery require at least eight characters.
Changing your password closes every session of this account, even this one, so afterwards you sign in again. Today this is the way to sign out any other device that's signed in to your account.
Authentication: two-factor, sign-in alerts and devices
The “Authentication” page has two rows marked “Soon”: “Two-factor sign-in” with a code from Flowra's Telegram bot, and “New sign-in alert”. Neither is available yet, and there is no switch to turn them on.
The “Active sessions” card doesn't show the device list yet either; coming soon. What works today is “Sign out of this device”, which closes the session on the server itself, and changing your password, which closes every session.
Screen lock
“Screen lock” in settings takes a four-digit PIN and an auto-lock time: after that many idle minutes (no mouse movement, key, touch or scroll) the screen locks. If the device has a fingerprint sensor, “Add this device's fingerprint” adds fingerprint unlock too.
Anywhere in the app, Shift and L or Ctrl and L locks the screen instantly (Shift and L doesn't work while you're typing in a text box), and the lock button at the top of the screen does the same. On the lock screen, you enter your PIN and carry on right where you were.
The lock belongs to this browser: the PIN is stored on the device itself and never goes to the server, it's set up separately on each device, and it doesn't close your session. So the screen lock is for eyes around the desk; on a shared device, sign out.
- Open Settings, “Account and security”, “Screen lock”
- Enter a four-digit PIN and repeat it once more
- Enter the auto-lock time in minutes and tap “Enable lock”
- From now on, Shift and L or the lock button locks the screen instantly
Roles and access in a workspace
Every workspace has three roles: owner, editor who sees, adds and edits data, and viewer who only sees. Renaming the workspace and its workflow is for the owner only, and adding or removing members is for the owner or an editor with permission to invite.
Each member also has an “Access scope”: the whole workspace, a specific company or project, or no project at all. “Finance visibility”, from none up to finance manager, decides how much of the workspace's money they see, and “Access expiry” sets an end date after which access ends by itself.
A project guest sees only that project, sees nothing until they accept the invite, and the project's money stays hidden from them unless they have the finance manager role. A private project is for its own members only.
Sharing and access levels
A Docs page is private, open to all workspace members, or shared with specific people. Each person gets one of three levels: “Can view”, “Can comment” or “Can edit”, and anyone who can edit a page can share it.
Files and folders you share in My Files are view-only for others, and only their owner can change or delete them. A shared note is read-only for the recipient too. Mentions and sharing never show anyone something they weren't already allowed to see.
Card and account numbers
On each finance account's details page, card and account numbers are shown with their last four digits. “Show full” first asks for your sign-in password, and the reveal is recorded in the security history; copying the number is only possible after that. When you leave the page, the numbers are hidden again.
MCP tokens
Every AI app you connect to Flowra gets its own token: it's shown only once, Flowra keeps only its hash, and it has only the access you picked. A token can never do more than you can, and finance is read-only through this route. Every call is logged, and “Revoke” cuts it off that very moment. The details are on the MCP page.
Where files and data live
Files are kept in private storage and have no public link. Every file address in Flowra is an internal path that first checks your permission (the file's owner, someone the file was shared with, a member of the chat the file is in, or a meeting participant for its recording) and then hands out a five-minute link. Someone without permission gets the same reply as for a file that doesn't exist.
App pages can't be framed inside another site, and the browser's security headers are on for every page. Deleted files stay in the trash for 21 days and Docs pages for 30 days.
CSV export is available per list, such as an account's transactions, actions or My Network; a single export of the whole account isn't there yet; coming soon. Account deletion isn't in the app either; send the request from the contact page.
Cookies and preferences
The first time you open Flowra, “Cookies and your preferences” asks what should be stored. There are only two groups: “Necessary”, meaning your sign-in session and security counters, which is always on, and “Preferences”, meaning language, theme, calendar and display mode. No advertising or analytics trackers.
“Accept all”, “Necessary only” or “My choice”. Turning preferences off clears them from this browser. Your choice is also saved on your account, and on the “Cookie policy” page you can clear it so you're asked again.
On phones
On your phone, “Account and security” is on the settings page: change password, authentication and screen lock, with the lock's on or off status beside it. The lock button is at the top of every screen; there's no keyboard on a phone, so that button is the way to lock instantly.