Security at FlexDays
Last updated 10 October 2026 · Effective 10 October 2026
Your company's HR data is sensitive, and we treat it that way. Here is how FlexDays protects it, in plain language. We only list what is actually in place today.
1. Data in transit
Encrypted connections
All traffic between your browser or phone and FlexDays uses TLS (HTTPS). Plain HTTP is redirected, and browsers are told to always use HTTPS (HSTS).
Certificate pinning on mobile
The FlexDays apps check that they are talking to our real servers, so a compromised Wi-Fi network can't quietly intercept requests.
2. Network protection
Cloudflare in front
FlexDays sits behind Cloudflare's network and firewall, and our servers accept traffic only through that layer, so they can't be reached directly.
Rate limiting
Sign-in and other sensitive endpoints are rate limited to slow down automated attacks.
3. Company data isolation
FlexDays is used by many companies at once. Each company's data is separated inside the database itself using row-level security: every query is limited to the signed-in company by the database, not only by our application code. Even a mistake in our code could not show one company's data to another.
4. Account protection
Hashed passwords
Passwords are stored only as bcrypt hashes. We can't see or recover your password.
Lockout
Repeated failed sign-in attempts temporarily lock the account, and verification codes allow a limited number of tries.
Short-lived sessions
Access tokens expire after 15 minutes. Session tokens are stored as one-way hashes, and changing your password signs out your other sessions.
Secure storage on phones
On iOS and Android, sign-in tokens are kept in the Keychain or Keystore, the secure storage built into the phone.
5. Access and audit trail
FlexDays shows each person only what their role allows: employees see their own records, managers see their teams, and administrators manage the workspace. Changes are recorded in an audit trail (who changed what, and when), so administrators have a clear history.
6. Payments
Payments are handled by Paddle, our Merchant of Record and a PCI DSS compliant payment provider. Card details go straight to Paddle and never touch FlexDays' servers. Payment notifications from Paddle are verified with a cryptographic signature, so they can't be forged.
7. Privacy by design
The FlexDays apps and web portal contain no advertising or analytics trackers. We collect what the service needs, and our Privacy Policy lists every provider that processes data for us.
8. Report a security issue
If you think you've found a security problem in FlexDays, please email support@beanvoid.com with the details. Please don't access other people's data or disrupt the service while testing. We'll reply quickly, keep you updated, and credit you if you'd like.