Legal
Security
Flint AI is operated by Aaron Edwards, trading as Flint AI
Flint AI takes security seriously and aims to use sensible technical and organisational measures to protect the information, integrations, and workflows it handles.
On this page
This page provides a general overview of Flint's security approach. It does not create a separate contractual warranty unless agreed in writing with a client.
1. Security principles
Flint's security approach is based on limiting access to what is needed, keeping client data scoped and separated where supported by the system design, storing sensitive credentials server-side, avoiding exposure of API secrets in frontend code, using approval-based workflows for important actions, maintaining audit logs for key operational actions, reducing unnecessary data collection, disconnecting integrations when no longer needed, and reviewing risks as the platform evolves.
2. Connected account security
Where Flint connects to services such as Google Business Profile, Facebook, Instagram, Messenger, Stripe, Telegram, or other platforms, Flint may store access tokens or credentials needed to operate the authorised integration.
These should be handled server-side and used only for authorised client workflows.
Clients can request disconnection of integrations where they no longer want Flint to access a connected service.
3. Client isolation
Flint is being built as a multi-client operations platform.
Client data and workflows should be scoped so that each client's connected accounts, content, bookings, messages, approvals, and integrations are kept separate from other clients.
Where applicable, Flint may use client identifiers, execution scopes, environment separation, permissions, and audit logs to support client isolation.
4. Approval and audit
Important actions, such as social publishing, profile updates, customer communications, review responses, or connected account actions, should be approved by the client or controlled by client-configured permissions.
Flint may keep audit logs showing who requested an action, what content or action was proposed, who approved it, where it was sent or published, whether it succeeded or failed, and relevant third-party platform response information.
5. User responsibilities
Clients and users are responsible for protecting their own passwords, protecting devices used to access Flint or connected platforms, only connecting accounts they are authorised to manage, reviewing AI-generated or operator-generated content before approval, telling Flint promptly if they suspect unauthorised access or misuse, and managing admin access inside third-party platforms such as Google, Meta, Stripe, Telegram, and other tools.
6. Limitations
No online service can guarantee perfect security.
Flint relies partly on third-party platforms, hosting providers, APIs, business tools, and client-controlled accounts. Security may also depend on how clients manage their own accounts, devices, passwords, and permissions.
7. Reporting a security concern
If you believe you have found a security issue or have a concern about unauthorised access, contact: hello@flintai.co.uk
Please include enough detail for us to understand and investigate the issue.
8. Contact
For security questions, contact:
Flint AI
hello@flintai.co.uk