FloConnectorDocs

Sign-in and security

FloConnector signs you in with a six-digit code emailed to you, so there is no password to forget, reset, or leak.

Signing in

  1. Enter your email on the dashboard sign-in page.
  2. Open the FloConnector email and type the six-digit code back into the tab you started from. It is single-use and expires in 15 minutes.
  3. You are signed in in that browser until the session ends or you sign out.
Code expired, or too many wrong tries?

Just request a new one. Codes are meant to be short-lived, and after five incorrect attempts the code is retired on purpose. Asking again is the normal way back in.

The link in that email

The email also carries a link, but it does not sign you in. It only reopens the screen where the code goes, with your email already filled in, for when you close the tab before you have finished. Clicking it is always safe and never uses anything up.

The code is the only thing that signs you in, and that is deliberate. A link that could sign you in has two problems FloConnector cannot control:

  • Your default browser. A clicked link opens in whatever browser your computer is set to open links with. If you were signing in from a different one, you would end up signed in somewhere you are not even looking. A code signs in the tab you type it into.
  • Corporate email scanning. Security products like Microsoft Safe Links, Mimecast, and Proofpoint open the links in your mail before you do, to check them. A single-use sign-in link can be spent that way before you ever click it. A code has nothing to open.

Your vendor tokens

The credentials that matter most are your vendors' OAuth tokens, and they never leave FloConnector in the clear:

  • They are envelope-encrypted before storage. The database never holds plaintext.
  • Your AI client never receives them. The client calls FloConnector; FloConnector calls the vendor.
  • You can revoke FloConnector's access from the vendor's own account at any time, which immediately stops the connection.

Leaving

Removing a connection deletes its encrypted tokens from the vault. Closing an account removes its data on the same principle FloConnector runs on: keep as little at rest as possible.