Architecture and engineering
How Flowtor is built
Buyers, suppliers, factories and logistics partners coordinate real orders in Flowtor, so how it is engineered matters as much as what it does. This page explains the principles and mechanisms behind it, without claims we cannot stand behind.
Engineering principles
Reality first
The system reflects what has actually happened, not what was promised. Changes carry a source, a time and an actor, so Flowtor can say why it believes something is true.
Security by design
Organisations work together without seeing into one another's business. Isolation and access are part of the data model, not a layer added later.
Automation assists, people decide
Software watches operations, detects gaps and drafts follow-ups. It does not invent operational state, and decisions that belong to a person stay with a person.
Incremental, verifiable delivery
Capability is added in small, reviewable steps, checked against a known baseline before it ships.
Operational transparency
Significant architecture decisions are recorded and version-controlled. Meaningful actions are logged with who did what, when and in which role.
Customer-led configuration
Behaviour follows each organisation's own operating rules rather than imposing one way of working.
How that shows up in the product
Organisation-level isolation
Every record belongs to one organisation, and separation is enforced by row-level security on the server, not only in the interface. A buyer, its suppliers and their factories can work on the same orders while each sees only what belongs to them.
Role-based access
Permissions apply at feature and record-type level, so larger teams can be administered with the boundaries they need.
Traceable history
Key business actions are recorded: what changed, who did it, when, and the role they held.
Governed change
Releases follow a documented runbook and a production-readiness checklist, with automated checks against a baseline.
Services Flowtor runs on
For your own due diligence, these are the main external services involved in running Flowtor today:
- Base44: application platform, database, authentication and file storage.
- AI processing through Base44's AI gateway, currently using Google Gemini models for document and email extraction.
- Resend: transactional email such as notifications and invitations.
- Microsoft 365: the mailbox used for order emails, where that feature is in use.
- Stripe: payment processing, where online payment is used.
We are glad to walk your security, architecture and procurement teams through how the platform is built and how your data is separated. Responsible-disclosure reports are always welcome at hello@flowtor.com.
Running a technical review?
Tell us what your reviewers need and we will go as deep as they want.