Security
Flowion operates infrastructure that connects real EV chargers to real organizations' fleets, so we treat authentication, authorization, and data isolation as core to the product, not an afterthought. This page describes what's actually true of the running system today.
Encryption in transit#
Every connection into the platform runs over TLS — browser sessions to the dashboard, API calls to the management API, and every charger's OCPP-J WebSocket connection to the gateway. Nothing talks to Flowion in plaintext.
Authenticating operators#
Signing in to the dashboard or calling the management API directly requires a valid ID token issued by our identity provider, Zitadel. Every request is verified against that instance's JWKS — signature, expiry, issuer, and audience are all checked before a request is treated as authenticated. There are no shared API keys or long-lived static secrets for operators.
Authenticating chargers#
Chargers authenticate over OCPP 1.6J Security Profile 2 — HTTP Basic Auth carried over TLS. Each charger's authorization key is hashed with Argon2id before it's ever written to the database; we don't store the raw key, and can't recover it — only verify it. Keys can be rotated per charger at any time without needing physical access to the hardware.
Authorization and tenant isolation#
Every management API request is authorized against real organization membership — a person's actual role (Owner, Admin, or User) and, where applicable, the specific environments they've been granted access to — never a client-supplied tenant identifier. A request for an organization, environment, or charger you don't belong to returns the same "not found" response as one that doesn't exist, so unauthorized requests can't be used to enumerate other tenants' data.
Cross-origin requests to the API are restricted to known, explicitly allowed browser origins.
Infrastructure#
Flowion's backend runs as Rust services on AWS ECS Fargate, provisioned entirely through Terraform — infrastructure changes are code-reviewed like any other change, not made by hand against a console. The charger-facing gateway and the management API are deployed and scaled independently, so a deploy of one doesn't interrupt the other's live charger connections.
How we build#
Every change to the codebase is driven by a failing test written first. The API's OpenAPI specification is generated directly from the code that serves it, so documentation can't silently drift from what's actually deployed.
What we're still building#
We're not going to overstate where we are. Two things we're actively working toward:
- TLS client-certificate authentication for chargers (OCPP Security Profile 3), as a stronger alternative to Security Profile 2 for operators who want it.
- Database-level tenant isolation as a second, defense-in-depth layer underneath today's application-level authorization checks.
Reporting a security issue#
If you believe you've found a security vulnerability in Flowion, please email security@flowion.app with details. We take reports like this seriously and will respond as quickly as we can — please give us a reasonable chance to investigate and address an issue before disclosing it publicly.