Security
How flyclicks.io protects your business, review, and customer data — encryption, authentication, access control, and our honest compliance status.
What actually protects your data
Four practices, named specifically, instead of a padlock icon and a promise.
TLS 1.3 & AES-256 Encryption
Your data is encrypted in transit and encrypted again at rest.
OAuth 2.0 Google Integration
You sign in through Google. We never see or store a password.
Role-Based Access Controls (RBAC)
Admin, Manager and Viewer roles, enforced across every location on the account.
GDPR & Privacy Ready
Explicit consent flows and working deletion requests, built in rather than bolted on.
How We Protect Your Data
A detailed look at the controls behind the summary above, plus an honest account of where we are on formal compliance — we'd rather tell you exactly what's true today than overstate it.
Encryption in transit and at rest
All traffic to and from flyclicks.io is encrypted with TLS. OAuth tokens and other secrets are encrypted at rest using AES-256-GCM before they touch our database.
OAuth 2.0 for Google sign-in
We connect to your Google Business Profile through Google's official OAuth 2.0 flow. We never see or store your Google password, and you can revoke access at any time from your Google Account or your flyclicks.io dashboard.
Role-based access control
Team members are scoped to Admin, Manager, or Viewer roles, so people only see and do what their role allows across your locations.
Full audit trail
Sensitive actions — connecting a profile, changing automation rules, publishing a reply, inviting a user — are recorded in an audit log tied to the account that took them.
Per-organization data isolation
Every organization's data is logically isolated, so one customer's business and review data is never exposed to another.
Enterprise SSO (OIDC)
Enterprise customers can require single sign-on through any OpenID Connect provider — Okta, Microsoft Entra ID, and others. We do not currently support SAML.
Our Compliance Status, Honestly
flyclicks.io is a pre-launch product. We have designed the platform with security best practices from day one — including the encryption, access control, and audit logging described above — but we have not yet completed a formal third-party audit or certification such as SOC 2, ISO 27001, or PCI-DSS, and we do not claim to hold one. We are not a HIPAA-certified Business Associate; our architecture follows HIPAA-conscious data-handling practices, which is a different and lower bar than a completed compliance audit. Payment card data is handled entirely by our PCI-compliant payment processor (Razorpay) — we never see or store full card numbers. We plan to pursue formal certifications as the business scales, and will update this page the moment any of them are actually completed.
Reporting a Security Issue
If you believe you've found a security vulnerability in flyclicks.io, please email support@flyclicks.io with details. We investigate every report and will follow up directly.
For how we collect and use data, see our Privacy Policy and Data Processing Addendum.