Flux Security Posture

Last updated: September 2026

Flux handles two sensitive things on a merchant's behalf: the money side of a sale and a live conversation with their customers. We treat both as trust we have to earn continuously. This page explains, in plain terms, how we protect that trust — the controls we run today and the independent assurances we are working towards as we grow.

Our approach

We don't rely on any single control to keep the system safe — we layer defences so that abuse has to defeat several independent checks, and every attempt is slower, more expensive, and more visible than the last. Two of those layers are deterministic guarantees rather than best-effort:

Commercial integrity — the AI can suggest a price, but it can never authorise one. Every deal passes through server-side price checks before any discount is created, so no prompt trick can mint a discount below the floor a merchant sets.
Presentation integrity — what a shopper sees is sanitised on our server before it is shown, so attempts to inject content into the conversation are stripped out.

Commercial integrity — the AI can suggest a price, but it can never authorise one. Every deal passes through server-side price checks before any discount is created, so no prompt trick can mint a discount below the floor a merchant sets.
Presentation integrity — what a shopper sees is sanitised on our server before it is shown, so attempts to inject content into the conversation are stripped out.

Payments & card data

Payments &
card data

Flux never sees, stores, or processes raw card details. All payments — both shopper checkouts and merchant subscriptions — are handled by Stripe and Shopify on their own PCI-DSS certified infrastructure. Discounts are applied as time-limited codes; the transaction itself always completes inside the merchant's existing, trusted checkout.

Data & encryption

Encrypted in transit. All traffic to Flux is served over HTTPS/TLS.

Encrypted at rest. Our database and application platform encrypt stored data at rest by default.
Data minimisation. We collect only what a negotiation needs. We deliberately avoid holding sensitive personal data we don't require.
Segregated credentials. Privileged keys are held server-side only and never exposed to the browser; different integrations use separate secrets so none can act for another.

Our infrastructure runs on established providers (including Vercel, Supabase, Stripe and Shopify), each with their own security programmes and independent certifications.

Encrypted in transit. All traffic to Flux is served over HTTPS/TLS.

Encrypted at rest. Our database and application platform encrypt stored data at rest by default.
Data minimisation. We collect only what a negotiation needs. We deliberately avoid holding sensitive personal data we don't require.
Segregated credentials. Privileged keys are held server-side only and never exposed to the browser; different integrations use separate secrets so none can act for another.

Our infrastructure runs on established providers (including Vercel, Supabase, Stripe and Shopify), each with their own security programmes and independent certifications.

AI safety & abuse defence

AI safety &
abuse defence

Because Flux runs a public-facing AI, we assume it will be probed — and we design for that:

Server-side price guards clamp every quoted and minted price to the merchant's configured floor, independently of anything the model says.
Output sanitisation removes injected instructions and artefacts from replies before they reach a shopper.
Rate limiting and bot challenges make automated abuse expensive and slow.
Continuous review. Suspicious sessions — prompt-injection attempts, abusive language, anomalous timing and other signals — are automatically flagged into an internal review queue for human oversight.

Because Flux runs a public-facing AI, we assume it will be probed — and we design for that:

Server-side price guards clamp every quoted and minted price to the merchant's configured floor, independently of anything the model says.
Output sanitisation removes injected instructions and artefacts from replies before they reach a shopper.
Rate limiting and bot challenges make automated abuse expensive and slow.
Continuous review. Suspicious sessions — prompt-injection attempts, abusive language, anomalous timing and other signals — are automatically flagged into an internal review queue for human oversight.

Data protection & your rights

Flux is operated by FLUXAI GROUP HOLDINGS LTD and we handle personal data in line with UK GDPR. Merchants remain the data controller for their customers; Flux acts as a processor for the data involved in running a negotiation. We honour access, correction and deletion requests, and retain data only as long as needed for the service and our legal obligations.

For privacy or data-subject requests, or to ask what we hold, contact us at security@withflux.co.uk and we'll respond promptly.

Cerifications & roadmap

Certifications & roadmap

We believe in being straight about where we are. Below is our current posture and what we're actively working towards — we'll update this page as each milestone is reached, and we're happy to share more detail with merchants under evaluation.

Cyber Essentials

UK government-backed baseline of technical security controls. Certified 14 September 2026, valid to 14 September 2027 — verify this certificate.

SOC 2 Readiness

Readiness assessment ahead of a formal SOC 2 examination.

SOC 2 Type II / ISO 27001

Formal, audited certifications for enterprise assurance.

Reporting a vulnerability

We welcome responsible disclosure. If you believe you've found a security issue in Flux, please email security@withflux.co.uk with enough detail for us to reproduce it. Please give us a reasonable opportunity to investigate and remediate before any public disclosure. We're grateful to researchers who help us keep Flux safe and will acknowledge your report.