Skip to main content

Security

FluidGrids inherits its security model from the Burdenoff Workspaces platform. This guide covers what a workspace or organization administrator can configure and rely on.

Authentication​

  • Burdenoff Workspaces identity — one account across every Burdenoff product; sign-in by email and password, passwordless magic link, or Google / Microsoft where enabled
  • Enterprise SSO — SAML 2.0 and OIDC, configured per workspace under Auth › Security Settings (Enterprise plan)
  • MFA — TOTP-based multi-factor authentication, enforceable per organization
  • Sessions — every device is listed under Auth › Active Sessions and can be signed out remotely
  • API keys — issued from Developer Portal › API Keys, scoped to a workspace, rotatable, and audit-logged

Authorization​

  • RBAC — role-based access control at the workspace level, with six FluidGrids product roles (Automation Owner, Automation Lead, Workflow Designer, Integration Engineer, Run Operator, Automation Auditor) — see Roles and Permissions
  • Credential scoping — credentials are encrypted and isolated per workspace
  • Run isolation — workflow runs are scoped to the workspace that owns the workflow

A run can only read credentials belonging to its own workspace. There is no mechanism for a workflow in one workspace to reach another workspace's credentials, workflows, or run history.

Data protection​

  • Encryption at rest — AES-256 for connections (credentials) and sensitive configuration
  • Encryption in transit — TLS 1.3 for all external and internal communication
  • Database and cache — reachable only from inside the private service network; neither is exposed to the internet
  • Backups — encrypted and retained in region

Network​

  • No public datastore access — the database and cache accept connections only from within the private service network
  • Gateway-enforced entry — every request flows through the workspace gateway, which authenticates and authorizes before anything reaches a service
  • Segmented internal traffic — service-to-service traffic is restricted to the paths it is meant to take

Secrets​

Platform secrets are held in a managed secret store with per-environment isolation and are delivered to services at runtime — never baked into images and never committed to a repository.

Connections you add to FluidGrids (OAuth grants and API keys for the systems your workflows talk to) are encrypted at rest, scoped to your workspace, and never returned in plaintext through the API or UI once saved.

Compliance​

  • GDPR-ready data handling, with data residency in India
  • Audit logs for authentication and authorization events
  • Subprocessors disclosed in the privacy policy and DPA

Reporting a vulnerability​

Email [email protected]. Please include reproduction steps and hold off on public disclosure until we have responded.

Next steps​