Last updated: 2026-05-26
Security
Flicker is in a closed beta. This page describes the controls currently in place and the ones we have planned. We will update it as things change.
Encryption
At rest: disk-level encryption is configured on production hosts. Backups are encrypted in transit; at-rest encryption for backups is provided by the storage provider (Tigris/S3).
In transit:
all dashboard and API traffic is served
over TLS with certificates issued by Let's Encrypt. Postgres
endpoints at *.db.flickercloud.com
accept TLS; sslmode=require
is the documented default.
Tenant isolation
Tenant isolation is enforced through Postgres roles, per-database schemas, and per-database filesystem datasets. Isolation has not been independently audited; we encourage customers to report any cross-tenant exposure to security@flickercloud.com.
Backups and point-in-time recovery
Per-database backups run through CloudNativePG — continuous WAL archiving to object storage plus periodic volume snapshots — with an automated weekly restore drill. Point-in-time recovery (PITR) availability and retention windows are best-effort and may vary by database; no RTO/RPO commitment during beta.
Deleted customer data is purged from primary storage within 30 days; backup catalogs may retain data longer per backup retention policy.
Authentication and access
The dashboard uses email and password authentication with bcrypt password hashing. Signup is invitation-only and invitations are scoped to a single organization. API keys are issued per organization and stored hashed. We do not yet offer SSO or hardware-key MFA; both are on the roadmap.
Subprocessors
The vendors below process customer data or operational metadata on our behalf. We will give reasonable advance notice before adding a new subprocessor that touches customer data.
| Vendor | Purpose | Region |
|---|---|---|
| OVHcloud | Bare-metal compute, customer database hosting | US-East (Vint Hill, VA) |
| Fly.io | Control-plane application hosting | US-East (Ashburn, VA) |
| Supabase | Control-plane database (org, app, secret, and deployment metadata) | US-East |
| Tigris | S3-compatible storage for backups | US |
| Stripe | Billing and payment processing | US |
| Cloudflare | DNS and CDN | Global |
Data residency
Customer databases and backups are hosted in the United States, specifically the OVH Vint Hill, Virginia data center. We do not currently offer EU or other regional residency; that's planned for after Phase 1.
Penetration testing and audits
We have not yet engaged a third party for a formal penetration test. An external pen test is planned for after Phase 1. We do not hold SOC 2 or ISO 27001 attestations at this time.
Vulnerability disclosure
If you believe you have found a security vulnerability in Flicker, please email security@flickercloud.com with details and, where possible, steps to reproduce. We commit to:
- Acknowledging your report within 3 business days.
- Keeping you informed as we investigate and remediate.
- Coordinating public disclosure within 90 days of the report, sooner if the issue is already public or actively exploited.
- We will not pursue legal action against good-faith researchers who follow the disclosure terms below, to the extent permitted by applicable law. Good faith means: no data exfiltration beyond proof-of-concept, no service degradation, no access to other customers' data, and reasonable disclosure timelines.
Incident response
Security incidents are triaged by our on-call operator. We will notify affected customers without undue delay after becoming aware of a confirmed personal data breach, and in any event consistent with applicable law. See our Data Processing Addendum for more. For general security inquiries, contact security@flickercloud.com.