This translation is for convenience; the German version is legally binding. Read the German version
Security & privacy
This page only describes what CueFlow really does. How we process personal data is set out in the privacy policy.
Sign-in and access
- Passwords are only stored as a bcrypt hash, never in plain text.
- Two-factor sign-in with an app code (TOTP), plus recovery codes for emergencies.
- After several wrong attempts, sign-in is locked for that account.
- You can see your active sessions and sign out other devices.
- You get an email when someone signs in from a new device.
Encryption
- All connections are encrypted over HTTPS (with HSTS).
- Stored secrets – 2FA keys, access to connected calendars and services, webhook secrets – are kept encrypted with AES-256-GCM in the database.
- Uploaded files are scanned for viruses and can only be reached through time-limited links.
Who sees what
- Every company sees only its own bookings, invoices and team data.
- Teams have four clear roles – who can do what is clear at a glance.
- Important changes are logged.
Invoice data
- A finalised invoice is locked (GoBD): it can no longer be changed, only corrected with a cancellation invoice (Storno).
- Invoices are available as PDF and as XRechnung; paid invoices can be exported as CSV for your tax adviser.
- CueFlow takes no booking fee: invoices go directly from you to your clients.
Backups
- Before every update, the database is backed up and the backup is checked; no update starts without a valid backup.
- Updates run without downtime: the new version only takes over once it demonstrably works.
Your data, your rights
- You can download all your data as a file at any time (Settings → My data).
- You can have your account deleted. Deletion takes place after 30 days; until then you can cancel it.
- Data that the law requires us to keep (for example invoices) is only deleted after that period has expired.
- Consents are stored with their date and can be withdrawn.
Found a security vulnerability?
Please report it by email to support@cueflow.de with the subject “Security Disclosure”, and please don’t make it public before it has been fixed.
Questions about security and privacy
For questionnaires from your IT team or data protection officer, write to support@cueflow.de.