# Security at MockFlow

> How MockFlow protects your boards: SOC 2 certified infrastructure such as AWS and MongoDB, firewalls, monitoring, encryption, backups and secure development.

Source: https://mockflow.com/docs/security-at-mockflow

MockFlow is the visual canvas where teams plan products, map processes and design screens, so the boards you create often hold your most important ideas. Security is built into every layer of the service, from the servers that host your boards to the way the product is developed and the controls your admins use.

![A MockFlow board in the browser, inside three layers of protection: HTTPS for every transfer, network and application firewalls with intrusion alerts, and SOC 2 certified infrastructure such as AWS and MongoDB with every server monitored each minute. Below, code review and security scans, and continuous backups in separate locations](https://assets.mockflow.com/docs/media/d977912ec0e54783ab7f19133819a5dc.webp)

## Secure cloud infrastructure

- **SOC 2 certified infrastructure:** MockFlow runs on SOC 2 certified infrastructure such as Amazon Web Services (AWS) and MongoDB. MFA, key rotation, VPN access and other safeguards protect the servers.
- **Firewalls:** network and application level firewalls guard MockFlow, with intrusion detection and alerts.
- **Monitoring:** every server is monitored each minute for anomalies.

## Data protection and encryption

Every transfer between your browser and MockFlow uses HTTPS, and sensitive information such as passwords is encrypted with a 256-bit key. Customer data is backed up continuously to separate locations. See [How MockFlow encrypts your data](/docs/how-mockflow-encrypts-your-data) and [Where your data is stored and how it is backed up](/docs/where-your-data-is-stored).

## No AI training on your data

MockFlow never uses your boards, prompts, files or chats to train AI models, and never sends them to anyone for AI training, not even in an anonymized form. This applies on every plan, including Basic. See [How Mida and AI features handle your data](/docs/how-mida-handles-your-data).

## Protection against common attacks

Application level security guards MockFlow against attacks such as SQL injection and cross-site scripting (XSS):

- Strict content security policies
- Regular web application vulnerability scans
- OWASP Top 10 validation
- Checks with Qualys and Mozilla Observatory
- Network vulnerability testing with Qualys and AWS Detective

## Secure development

Security starts in how MockFlow is built. Every change goes through peer code review, and testing at the branch, integration and deployment stages catches issues before they ship. Third party libraries are kept current with security patches, and everyone on the MockFlow team is trained in secure coding, testing and deployment.

## Compliance

MockFlow was previously certified for SOC 2 Type II and ISO 27001, and a new SOC 2 Type II audit is under way. See [SOC 2 and ISO 27001 compliance](/docs/soc-2-and-iso-27001-compliance).

## Next steps

- [Security controls for team admins](/docs/security-controls-for-team-admins)
- [How Mida and AI features handle your data](/docs/how-mida-handles-your-data)
- [Security reviews and contacting MockFlow](/docs/security-reviews-and-contact)