reflex

Legal

Security

Last updated 7 September 2026

reflex is operated by Company Flow Pte. Ltd. (UEN 202442050M), trading as workFlowers. It holds a credential to your Notion workspace, so this page sets out exactly how that credential and your data are protected.

Notion access

  • You authorise reflex through Notion’s own OAuth screen. We never ask for, see or store your Notion password.
  • Access is limited to the pages and databases you share with the integration in Notion. Unshare something and reflex loses access immediately.
  • The OAuth grant itself is held by our connector gateway, operated by Lovable, which brokers every Notion call we make on your behalf. reflex stores only the key that identifies your connection to that gateway.
  • That key is encrypted at rest with AES-256-GCM using a secret held in the platform’s secret store rather than in the database, and is decrypted in memory only for the duration of a request or a flow run.
  • Disconnecting in reflex deletes the stored key straight away, so we can no longer reach your workspace. To withdraw the grant itself, remove the reflex integration from Notion’s side — you can do this at any time, with or without disconnecting here.

Tenant isolation

Every table carrying customer data is protected by database-level row security keyed to your account, so a query can only ever return your own rows — even if application code were wrong. Background workers resolve the owning account from the event before they touch anything, and events that map to no active connection are dropped without being stored or queued.

Data in transit and at rest

All traffic runs over TLS. Data is stored in managed Postgres with encryption at rest, automated backups and point-in-time recovery. Secrets and API keys live in the platform’s secret store and are only readable by server-side code, never by the browser.

Incoming webhooks

Notion webhook deliveries are verified with an HMAC-SHA256 signature over the raw request body, compared in constant time, before we act on them. Unverified requests are rejected with a 401. The receiver never calls back out to Notion, so a forged request cannot make us do work.

Outgoing webhooks

Flow steps may only call HTTPS endpoints. Requests to loopback, link-local and private network ranges are blocked, so a flow cannot be used to reach internal infrastructure.

Access control

Sign-in is via Google or an emailed magic link — there are no passwords for us to leak. Access to production systems is limited to the workFlowers staff who need it, protected by two-factor authentication, and used to inspect customer content only when you ask us to help debug something.

Retention

Run records include snapshots of the Notion content a step read or wrote. They are kept while your account is open, and deleting your account removes them along with everything else; automatic expiry after 90 days is on our roadmap but is not yet running, so please don’t rely on it. See the privacy policy for the full detail.

Dependencies

Third-party packages are pinned in a committed lockfile, and the platform we host on applies runtime patches for us. The services that process data on our behalf are listed on the sub-processors page.

Reporting a vulnerability

Email dennis@work.flowers with the details and steps to reproduce. We aim to acknowledge within two business days and will keep you posted on the fix. Please don’t test against other people’s workspaces or run denial-of-service attempts.

See also our privacy policy, terms of service and sub-processors pages.