Security Posture
Security Posture
Last updated: 8 October 2026
Last updated: 8 October 2026
Flux handles two sensitive things on a merchant's behalf: the money side of a sale and a live conversation with their customers. We treat both as trust we have to earn continuously. This page explains, in plain terms, how we protect that trust – the controls we run today and the independent assurances we are working towards as we grow.
Flux handles two sensitive things on a merchant's behalf: the money side of a sale and a live conversation with their customers. We treat both as trust we have to earn continuously. This page explains, in plain terms, how we protect that trust – the controls we run today and the independent assurances we are working towards as we grow.
Our approach
Our approach
Our approach
We don't rely on any single control to keep the system safe – we layer defences so that abuse has to defeat several independent checks, and every attempt is slower, more expensive, and more visible than the last. Two of those layers are deterministic guarantees rather than best-effort:
Commercial integrity – the AI can suggest a price, but it can never authorise one. Every deal passes through server-side price checks before any discount is created, so no prompt trick can mint a discount below the floor a merchant sets.
Presentation integrity – what a shopper sees is sanitised on our server before it is shown, so attempts to inject content into the conversation are stripped out.
We don't rely on any single control to keep the system safe – we layer defences so that abuse has to defeat several independent checks, and every attempt is slower, more expensive, and more visible than the last. Two of those layers are deterministic guarantees rather than best-effort:
Commercial integrity – the AI can suggest a price, but it can never authorise one. Every deal passes through server-side price checks before any discount is created, so no prompt trick can mint a discount below the floor a merchant sets.
Presentation integrity – what a shopper sees is sanitised on our server before it is shown, so attempts to inject content into the conversation are stripped out.
Payments & card data
Payments & card data
Payments & card data
Flux never sees, stores, or processes card details. Shoppers pay through the store’s own checkout, so Flux never touches shopper payments. Billing for Flux plans and commission is handled by Shopify, Stripe and Paystack on their own PCI DSS certified infrastructure. Discounts are applied as time-limited codes; the transaction itself always completes inside the merchant’s existing, trusted checkout.
Flux never sees, stores, or processes card details. Shoppers pay through the store’s own checkout, so Flux never touches shopper payments. Billing for Flux plans and commission is handled by Shopify, Stripe and Paystack on their own PCI DSS certified infrastructure. Discounts are applied as time-limited codes; the transaction itself always completes inside the merchant’s existing, trusted checkout.
Data & encryption
Data & encryption
Data & encryption
Encrypted in transit. All traffic to Flux is served over HTTPS/TLS.
Encrypted at rest. Our database and application platform encrypt stored data at rest by default.
Data minimisation. We collect only what a negotiation needs. We deliberately avoid holding sensitive personal data we don't require.
Access control. Administrative access to production systems is limited to named individuals on a least-privilege basis and protected by multi-factor authentication. Privileged keys are held server-side only, are never exposed to the browser, and each integration uses a separate secret so none can act for another.
Vendors sign in through their e-commerce platform’s own session – on Shopify, that means your Shopify account and whatever multi-factor protection you have enabled there. Flux does not hold a separate password for your store.
Our infrastructure runs on established providers (including Stripe and Shopify), each with their own security programmes and independent certifications. Live service status is published on our status page.
Encrypted in transit. All traffic to Flux is served over HTTPS/TLS.
Encrypted at rest. Our database and application platform encrypt stored data at rest by default.
Data minimisation. We collect only what a negotiation needs. We deliberately avoid holding sensitive personal data we don't require.
Access control. Administrative access to production systems is limited to named individuals on a least-privilege basis and protected by multi-factor authentication. Privileged keys are held server-side only, are never exposed to the browser, and each integration uses a separate secret so none can act for another.
Vendors sign in through their e-commerce platform’s own session – on Shopify, that means your Shopify account and whatever multi-factor protection you have enabled there. Flux does not hold a separate password for your store.
Our infrastructure runs on established providers (including Stripe and Shopify), each with their own security programmes and independent certifications. Live service status is published on our status page.
AI safety & abuse defence
AI safety & abuse defence
AI safety & abuse defence
Because Flux runs a public-facing AI, we assume it will be probed – and we design for that:
Server-side price guards clamp every quoted and minted price to the merchant's configured floor, independently of anything the model says.
Output sanitisation removes injected instructions and artefacts from replies before they reach a shopper.
Rate limiting and bot challenges make automated abuse expensive and slow.
Continuous review. Suspicious sessions – prompt-injection attempts, abusive language, anomalous timing and other signals – are automatically flagged into an internal review queue for human oversight.
Because Flux runs a public-facing AI, we assume it will be probed – and we design for that:
Server-side price guards clamp every quoted and minted price to the merchant's configured floor, independently of anything the model says.
Output sanitisation removes injected instructions and artefacts from replies before they reach a shopper.
Rate limiting and bot challenges make automated abuse expensive and slow.
Continuous review. Suspicious sessions – prompt-injection attempts, abusive language, anomalous timing and other signals – are automatically flagged into an internal review queue for human oversight.
Data protection & your rights
Data protection & your rights
Data protection & your rights
Flux is operated by FLUXAI GROUP HOLDINGS LTD and we handle personal data in line with UK GDPR. We are registered with the UK Information Commissioner's Office under reference ZC173568, verifiable on the ICO's public register.
Our role. Flux is an independent data controller for the personal data it collects through a negotiation – negotiation activity, device and security signals, and any email address a shopper chooses to give us. We decide for ourselves to collect those signals in order to detect fraud and manipulation of negotiations. That is our own purpose rather than an instruction from the merchant, and it is what makes us a controller rather than a processor. As the seller, the merchant remains the controller of their own customer and order records. Neither party acts as the other’s processor.
Why that means there is no DPA to sign. An Article 28 data processing agreement is required where one party processes on another’s documented instructions. Because we each act as a controller for our own processing, no DPA is required between Flux and a merchant. What a merchant does need to do is name Flux in their own privacy notice and link to ours, because shopper data is being shared with a separate controller. We can provide a short controller-to-controller data sharing note for your records on request.
We do not train on your data. Shopper conversations are sent to our AI providers only to generate a reply in the moment. We do not use conversation content to train foundation models, and our providers do not use it to train theirs. We do analyse negotiation outcomes in aggregate – which offers were accepted and at what price – to improve how the service performs. That analysis uses deal economics, not conversation content and nothing that identifies a shopper.
How long we keep it. These limits are enforced automatically by a scheduled job, not by manual review.
A negotiation where no deal was agreed is stripped of identifying data 90 days afterwards.
A negotiation where a deal was agreed is stripped after 12 months, so commission can be reconciled and disputed.
Expired sign-in credentials are deleted 30 days after they expire.
Order and commission records are kept for six years for UK accounting and tax. These are deal economics, not shopper identifiers.
Stripping removes the identifying fields – IP address, device fingerprint, browser details, message content and any email address – while keeping non-identifying deal economics for accounting. For Shopify stores we also action Shopify’s verified customer data-request and erasure webhooks automatically. We honour access, correction and deletion requests.
Suppliers. A current list of our sub-processors – what each one does, what personal data it sees and where it is located – is available on request at privacy@withflux.co.uk. We will tell you before adding a sub-processor that materially changes how negotiation data is handled.
Data residency. The database holding negotiation records is hosted in the EU (AWS Stockholm). Some processing – our serverless functions, and our bot-protection, email and AI model providers – takes place outside the UK and EEA, under standard contractual clauses with the UK Addendum or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. We maintain a per-provider record of which mechanism applies and will share it with enterprise customers on request.
Flux is operated by FLUXAI GROUP HOLDINGS LTD and we handle personal data in line with UK GDPR. We are registered with the UK Information Commissioner's Office under reference ZC173568, verifiable on the ICO's public register.
Our role. Flux is an independent data controller for the personal data it collects through a negotiation – negotiation activity, device and security signals, and any email address a shopper chooses to give us. We decide for ourselves to collect those signals in order to detect fraud and manipulation of negotiations. That is our own purpose rather than an instruction from the merchant, and it is what makes us a controller rather than a processor. As the seller, the merchant remains the controller of their own customer and order records. Neither party acts as the other’s processor.
Why that means there is no DPA to sign. An Article 28 data processing agreement is required where one party processes on another’s documented instructions. Because we each act as a controller for our own processing, no DPA is required between Flux and a merchant. What a merchant does need to do is name Flux in their own privacy notice and link to ours, because shopper data is being shared with a separate controller. We can provide a short controller-to-controller data sharing note for your records on request.
We do not train on your data. Shopper conversations are sent to our AI providers only to generate a reply in the moment. We do not use conversation content to train foundation models, and our providers do not use it to train theirs. We do analyse negotiation outcomes in aggregate – which offers were accepted and at what price – to improve how the service performs. That analysis uses deal economics, not conversation content and nothing that identifies a shopper.
How long we keep it. These limits are enforced automatically by a scheduled job, not by manual review.
A negotiation where no deal was agreed is stripped of identifying data 90 days afterwards.
A negotiation where a deal was agreed is stripped after 12 months, so commission can be reconciled and disputed.
Expired sign-in credentials are deleted 30 days after they expire.
Order and commission records are kept for six years for UK accounting and tax. These are deal economics, not shopper identifiers.
Stripping removes the identifying fields – IP address, device fingerprint, browser details, message content and any email address – while keeping non-identifying deal economics for accounting. For Shopify stores we also action Shopify’s verified customer data-request and erasure webhooks automatically. We honour access, correction and deletion requests.
Suppliers. A current list of our sub-processors – what each one does, what personal data it sees and where it is located – is available on request at privacy@withflux.co.uk. We will tell you before adding a sub-processor that materially changes how negotiation data is handled.
Data residency. The database holding negotiation records is hosted in the EU (AWS Stockholm). Some processing – our serverless functions, and our bot-protection, email and AI model providers – takes place outside the UK and EEA, under standard contractual clauses with the UK Addendum or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. We maintain a per-provider record of which mechanism applies and will share it with enterprise customers on request.
For privacy or data-subject requests, or to ask what we hold, contact us at privacy@withflux.co.uk and we'll respond promptly.
Certifications & roadmap
Certifications & roadmap
Certifications & roadmap
We believe in being straight about where we are. Below is our current posture and what we're actively working towards – we'll update this page as each milestone is reached, and we're happy to share more detail with merchants under evaluation.
We believe in being straight about where we are. Below is our current posture and what we're actively working towards – we'll update this page as each milestone is reached, and we're happy to share more detail with merchants under evaluation.
Cyber EssentialsCertifiedUK GDPRRegistered · ZC173568Evaluating Flux for your store? We're happy to share more detail at security@withflux.co.uk
Evaluating Flux for your store? We're happy to share more detail at security@withflux.co.uk
If something goes wrong
If something goes wrong
If something goes wrong
If we discover a security incident affecting personal data we hold, we will tell affected merchants without undue delay — what we know, what we are doing about it, and what you may need to do. Where an incident is reportable, we will notify the ICO within 72 hours of becoming aware, as UK GDPR requires. We will not wait for an investigation to conclude before telling you one is underway.
If we discover a security incident affecting personal data we hold, we will tell affected merchants without undue delay — what we know, what we are doing about it, and what you may need to do. Where an incident is reportable, we will notify the ICO within 72 hours of becoming aware, as UK GDPR requires. We will not wait for an investigation to conclude before telling you one is underway.
Reporting a vulnerability
Reporting a vulnerability
Reporting a vulnerability
We welcome responsible disclosure. If you believe you've found a security issue in Flux, please email security@withflux.co.uk with enough detail for us to reproduce it. Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We're grateful to researchers who help us keep Flux safe and will acknowledge your report.
We welcome responsible disclosure. If you believe you've found a security issue in Flux, please email security@withflux.co.uk with enough detail for us to reproduce it. Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We're grateful to researchers who help us keep Flux safe and will acknowledge your report.