Security
How Fliok protects your data
What we do to keep your workspace, your customers and your keys safe, stated plainly. Each point is how Fliok works today.
Last updated 19 October 2026
Encryption
Encrypted on the way and on the disk
How your data travels to Fliok and how it is kept on our server.
HTTPS only
Traffic to and from Fliok is encrypted with HTTPS. Every page tells your browser to use only HTTPS for fliok.com and its subdomains, for a year.
Your keys and tokens are encrypted
Meta access tokens, payment and store credentials, webhook secrets and the other keys you give Fliok are encrypted with AES-256-GCM before they are saved.
An encrypted disk for your data
The database and the files stored in Fliok, such as media, are kept on an encrypted disk volume on our server.
Held in India
The servers that hold Fliok and its database are in India.
What is not end-to-end encrypted
WhatsApp chats through Meta’s Cloud API are not end-to-end encrypted. Fliok stores your messages so that your team can read and answer them.
Backups
Nightly backups, kept off the server
So a failure on our server does not lose your data.
Encrypted before they leave
The database is backed up every night to off-site storage. Each copy is encrypted with AES-256 before it leaves our server.
Kept on a schedule
Daily copies are kept for 30 days, and one copy a month for 12 months. Backups are used only to restore Fliok after a failure.
Checked every night
Each night’s copy is decrypted and checked before it is uploaded. Older copies are removed only after the new one has passed.
Workspaces
Your workspace is yours alone
Many businesses use Fliok. None of them can see your data.
Every record carries your workspace
Your contacts, chats, messages, templates, broadcasts and bookings each carry your workspace’s ID, and the database will not save one without it.
Every request is checked
Each request is limited to the workspace you are signed in to. Asking for another workspace’s record gets “not found”.
Sign-in and access
Who can get in, and what they can do
No passwords, short-lived codes, and controls for each person on your team.
No passwords
You sign in with a one-time code sent to your email, or with your Google account. There is no Fliok password to steal or reuse.
Codes that expire
A sign-in code works for 10 minutes. After five wrong tries, every code for that address is cancelled and none works for 10 minutes.
Two-step verification
Turn it on and Fliok also asks for the code from your authenticator app. Ten one-time recovery codes get you in if you lose your phone.
Roles
Each person in a workspace is an owner, an admin, an agent or a viewer.
Restrictions for one person
The owner or an admin can take more away from one team member: hide customers’ numbers, limit them to their own chats and leads, or switch off exports, sending to many, deleting and anything to do with money.
An activity log
Fliok records who did what in your workspace, on every plan. The owner and admins can read the activity log on Pro and Enterprise.
API and webhooks
Keys and webhooks you can trust
For the apps and websites you connect to Fliok.
API keys are stored as hashes
Fliok keeps only a keyed hash of each API key. The key itself is shown once, when you create it.
Keys you can narrow
A key can be limited to chosen scopes and to the addresses it may be used from, given an expiry date, and revoked at any time.
Signed webhooks
Every webhook Fliok sends is signed with HMAC-SHA256 using your endpoint’s secret and carries a timestamp, so you can check it came from Fliok.
We check who is calling
Fliok accepts messages from Meta and payment notices from Razorpay only when their signature is valid. Anything else is refused.
Pages other sites can’t frame
No other website can show Fliok inside a frame, except the Shopify or WordPress admin you connect it to. Every page is sent with standard browser security headers.
Who processes data
The companies that help run Fliok
Listed in full, with what each does and where, in our Privacy Policy.
One list, in the Privacy Policy
Section 4 of our Privacy Policy names every company that processes personal data for Fliok, what it does for the service and where it processes data. We update it when one is added or replaced.
Payments
Card and bank details are entered with Razorpay and are not stored by us.
If something goes wrong
If a personal data breach affects your workspace, we tell the workspace owner without undue delay: what happened, what data was involved, and what we are doing about it.
Report a problem
Found a security problem?
Please tell us privately before you share it with anyone else. Write to us at either address below.
The same contacts are in our security.txt file. For anything else, see the Privacy Policy.