How Coavon keeps your work safe
What protects your account and your data today, who can see what, and the things we do not offer yet. Plainly, so you can decide for yourself.
Signing in
- Sign in with your email and password, or with your Google account. New accounts confirm their email address with a one-time code.
- Two-step verification on every plan: add an authenticator app or an emailed code as a second step, with 10 recovery codes in case you lose your phone.
- When two-step verification is on, the database itself refuses your data until the second step is done, not only the screen.
- One sign-in covers every Coavon app, so there are fewer passwords to manage.
- See when, where and on what device each account signed in. Pro
Who sees what
- Each organization's work is kept apart by rules in the database, so one organization can never read another's.
- Owner, Admin and Member roles decide who can invite people, change settings, see billing and delete things, in Workplace, Flow and Scope.
- Make your own roles, such as Contractor or Customer support, each with its own permissions. Pro
- Flow workspaces are private to their members. Guests see only the one project they are invited to.
- Notes are private to the person who writes them. Files in Drive are yours until you share them.
Protecting your data
- Everything travels over an encrypted connection (HTTPS), between your browser and Coavon and between Coavon and the services it uses.
- Your work is stored by Supabase (the database) and Cloudflare (files), which encrypt it where it is stored.
- Payments are taken by Stripe. Coavon never sees or stores your full card number.
- Coavon does not sell your information and does not use your data to train AI.
A record of what happened
- The audit log lists every important change in the organization, with the person and the time: members, roles, billing, sharing and permanent deletions. Search it, filter it and export it. Business
- Documents keep their version history, so an earlier version can be brought back. How far back depends on your plan.
- Deleted Flow projects wait in a trash for 14 days before they are gone. Pro
Leaving, and deleting
- Export your work before you go: see what each app can export on the Integrations page. What each app can export
- When you delete your account or organization, it disappears from the apps at once and its subscription is cancelled. It is kept for 30 days in case you change your mind, then deleted for good.
- You can restore it yourself during those 30 days.
What we don't have yet
Coavon is a young product. These are the things larger companies often ask for that we do not offer today.
Security certifications
Coavon has no SOC 2 or ISO 27001 certification yet. If your company needs one, write to us and tell us what you need.
Single sign-on through your company directory
You can sign in with Google, but not yet through Microsoft or a company directory such as Okta (SAML).
A public uptime figure
We do not yet publish an uptime guarantee or a status page.
Who handles your data
Coavon is built on a small number of well-known services. Each one receives only what it needs to do its job. The privacy policy has the full detail.
- SupabaseStores your account and your work, and handles sign-in.
- VercelRuns the Coavon apps and this website.
- CloudflareStores the files you upload to Drive and attach to tasks.
- StripeTakes payments and stores payment details.
- ResendSends Coavon's emails, such as invitations and notifications.
- AnthropicAnswers questions in Flow's AI assistant, only when someone uses it.
Questions
Found a security problem? Email hello@coavon.com.
Yes. Two-step verification is on every plan, including Free. Each person turns it on for their own account in Workplace, under Account, Sign-in and security.
No. What each person can do depends on their role, Flow workspaces are private to their members, and guests see only the project they were invited to. Notes are always private to the person who wrote them.
No. Coavon does not use your data to train AI. If you use Flow's AI assistant or connect your own AI assistant, what you ask is handled under that provider's privacy terms.
Yes. Flow exports every task and project in a workspace as a spreadsheet or JSON file, Scope exports any list as a spreadsheet, Docs downloads as Word, PDF and more, and Drive files can be downloaded. The Integrations page lists what each app can export.
Not yet. If your company needs a certification or a security questionnaire answered, write to hello@coavon.com and we will tell you plainly what we can and cannot provide.
Email hello@coavon.com with what you found and how to see it. Please do not share it publicly until we have had a chance to fix it.
Try Coavon with your team
Every app, on one account. Your first 14 days are on Pro, with no card needed. After that it stays free for one person.