We don't rely on marketing slogans or unverified badges. StarX-Flow protects your merchant data and client conversations through database-level isolation, cryptographic webhook verification, and immutable audit trails.
StarX-Flow secures appointment-driven businesses through six architectural pillars: (1) PostgreSQL Row Level Security (RLS) enforcing strict tenant isolation at the database engine level; (2) HMAC-SHA256 cryptographic signature validation on all Meta WhatsApp and Instagram webhooks; (3) PostgreSQL exclusion constraints (btree_gist) preventing overlapping appointment ranges; (4) Engine-level immutable audit logging prohibiting log updates or deletions; (5) TLS 1.3 transport encryption and AES-256 storage encryption; and (6) Programmatic GDPR Article 17 and 20 endpoints for customer data export and right-to-erasure compliance.
Every database query executed by staff or AI agents is bounded by PostgreSQL Row Level Security policies. Tenants cannot view or access data belonging to any other business.
Every incoming message payload from WhatsApp and Instagram is validated using Meta's HMAC-SHA256 signature header (x-hub-signature-256) before entering processing pipelines.
To mathematically prevent scheduling conflicts, appointments are constrained by PostgreSQL btree_gist exclusion constraints over timestamp ranges, locking slots at the database layer.
Every administrative action and AI agent execution is recorded in an append-only audit trail protected by database triggers that prohibit UPDATE and DELETE operations.
All network traffic is encrypted using TLS 1.3 with HTTP Strict Transport Security (HSTS) enforced. Persistent data is stored in managed Supabase PostgreSQL with disk-level AES-256 encryption.
Merchants can fulfill consumer data protection requests automatically using verified programmatic endpoints for full JSON data export and permanent cascade deletion.
We exclusively deploy on enterprise cloud infrastructure maintaining accredited security certifications.
| Sub-Processor | Operational Role | Accredited Standards |
|---|---|---|
| Supabase, Inc. | Managed PostgreSQL Database & Authentication | SOC 2 Type II Certified |
| Vercel, Inc. | Edge Application Hosting & Serverless Execution | SOC 2 Type II / ISO 27001 |
| Meta Platforms, Inc. | WhatsApp Cloud API & Instagram Messaging | Enterprise Privacy Shield |
| Google LLC | Google Calendar API & Gemini AI Inference | SOC 2 / ISO 27001 / HIPAA |
| Microsoft Corporation | Microsoft Graph Calendar API | SOC 2 / ISO 27001 |
| Stripe, Inc. | Payment Processing & Billing Subscriptions | PCI-DSS Level 1 Service Provider |
We welcome responsible security research. If you believe you have discovered a potential vulnerability in StarX-Flow, please contact our security engineering team directly. We commit to acknowledging all submissions within 24 hours.