Flowzito Security & Data

Security contact: hai@zhouworks.com

Local-first data architecture

Flowzito is designed so that most processing and storage happen on the user's device.

The current primary data flow can be summarized as:

User device ⇄ Flowzito ⇄ Autodesk Forma / Autodesk services

Read and write requests are sent directly from the application on the user's device to Autodesk using the user's Autodesk account.

In the current implementation, there is no separate Flowzito backend between the application and Autodesk Forma that relays or stores project data.

What is stored on the device

Flowzito may store locally:

• Workspace and Hub/Project metadata;
• linked-account metadata;
• dashboards and layouts;
• scenarios, filters, and tool preferences;
• job-history summaries;
• Data Connector preferences;
• checkpoints for certain operations;
• Data Connector datasets/CSV files downloaded from Autodesk;
• temporary files created during export, sharing, or PDF processing.

This data is stored in the application's sandbox. Flowzito currently does not apply an additional encryption layer to all AsyncStorage or document-storage content.

Sensitive authentication data such as OAuth tokens is therefore stored separately in Secure Store, while other local data also relies on device security and the organization's security policies.

What is exchanged with Autodesk Forma

When users open dashboards or run tools, Flowzito may directly read or write data in Autodesk Forma and related Autodesk services.

Depending on the feature, exchanged data may include:

• Hub, Project, folder, and file metadata;
• members and permissions;
• Reviews, RFIs, Issues, Forms, Assets, Submittals, and Schedule data;
• Data Connector jobs and datasets;
• uploaded files or new file versions;
• payloads required for an operation explicitly confirmed by the user.

Flowzito does not automatically send a full copy of project data to a separate Flowzito server.

Authentication

• Flowzito uses the Autodesk OAuth Authorization Code Flow with PKCE S256.
• The mobile application is a public client and does not embed a client secret.
• Current scopes include data:read, data:write, data:create, account:read, account:write, and openid.
• Flowzito may call Autodesk OpenID userinfo to obtain email or display-name information for the interface.

Token storage

On iOS/Android:

• access tokens, refresh tokens, and expiry information are stored using Expo SecureStore;
• tokens are not stored in AsyncStorage;
• signing out removes authentication secrets stored by Flowzito.

In the current web implementation:

• tokens are held only in memory for the running session;
• Flowzito does not write them to persistent local storage.

Network communication

Fixed endpoints in the current source belong to Autodesk, including:

• developer.api.autodesk.com
• api.userprofile.autodesk.com
• accounts.autodesk.com
• acc.autodesk.com for deep links

Flowzito may also download data directly from signed URLs provided by Autodesk.

The current binary-download helper does not attach the Autodesk bearer token to external signed URLs.

File import, export, and PDF processing

Flowzito performs many file operations directly on the device:

• user-selected Excel files are read locally to prepare import data;
• CSV reports may be generated and written to cache/local storage before sharing;
• PDFs may be downloaded from Autodesk, QR-processed on the device, then temporarily stored for sharing or uploaded back to Autodesk;
• sharing uses the operating-system share sheet and the user chooses the destination.

Logging and telemetry

Flowzito HTTP helpers are designed not to log bearer tokens or secret request bodies.

Some Data Connector diagnostic logs run only in development builds and may contain job identifiers or listing names for debugging.

The inspected source currently contains no third-party advertising, behavioral analytics, or crash-reporting SDK.

Write operations

Some Flowzito tools may modify data in Autodesk Forma, including operations such as:

• creating or copying folder structures;
• adding members;
• working with or inspecting permissions;
• uploading files;
• creating new file versions.

Where supported, Flowzito surfaces scope, preflight checks, conflicts, and results before or after an operation. Users remain responsible for confirming the correct Project, source, destination, and scope.

Important limits

Flowzito currently does not claim that:

• all local data is end-to-end encrypted by Flowzito;
• the application uses a zero-knowledge backend;
• the application is SOC 2, ISO 27001, or similarly certified unless independently assessed;
• every Autodesk operation supports full transactional rollback;
• a dedicated server-side telemetry/security monitoring system exists unless one is later implemented.

Reporting a security issue

If you discover a security issue, contact hai@zhouworks.com with the Flowzito version, platform, issue description, and reproduction steps.

Do not send access tokens, refresh tokens, or confidential project data by email.