Organisation isolation
Organisation-owned records are queried and authorised in the context of the signed-in user's active organisation membership.
SECURITY
Access controls for organisation-based client work.
This page describes controls present in the current BluWorkflow implementation. It does not claim a certification, external audit or service level that has not been established.
Roles and plan capabilities
Protected actions require both the relevant role permission and, where applicable, the subscription-plan capability. A role alone does not unlock a higher-plan feature.
Account controls
BluWorkflow supports password authentication, email verification and reset flows, access and refresh tokens, and optional authenticator-app multi-factor authentication with recovery codes.
Protected document access
Document upload and retrieval use authenticated, permission-checked, organisation-scoped routes. Download responses also apply content-type and browser isolation controls.
Audit logging
The application records defined security-relevant and business actions, including authentication, membership, role, case, document, workflow and billing events.
Security headers
Application responses configure controls including content-type protection, frame restrictions, a referrer policy, a permissions policy and a content security policy. Production HTTPS responses add transport security.
RESPONSIBLE USE
Security is shared with each organisation.
Users should protect account credentials, enable multi-factor authentication where appropriate, grant only necessary permissions and review organisation membership when responsibilities change.
Report a security concern
Send a clear description of the concern and steps to reproduce it. Do not include passwords, recovery codes, access tokens or unnecessary client data.
hello@bluworkflow.com