ClientFlow login and dashboard session
Security
Security architecture for Notion-powered delivery teams.
ClientFlow touches operational Notion workspaces, so security needs to be visible: OAuth lifecycle, token encryption, tenant isolation, data flow, replay behavior, and the enterprise roadmap.
Current posturePrivate pilot ready
Enterprise procurement items such as SOC 2, data residency, backup policy, and a public status page are roadmap items, not launch claims.
Architecture
How a status change becomes auditable Notion work.
Bounded Notion workspace authorization
Tenant validation, mappings, templates, preview
Durable queue and rate-limited worker
Projects, tasks, owners, dates, recurring deliverables
Failed-action replay without duplicating completed work
Data flow
Only the data needed to plan, execute, and explain a run.
- ConnectUser authorizes a Notion workspace with OAuth.
- EncryptWorkspace token is encrypted at rest before persistence.
- MapClientFlow stores database IDs, role mappings, schema hashes, and watched values.
- PreviewPlanner returns simulated project, task, relation, owner, and date changes.
- ExecuteWorker writes pages through a per-workspace rate-limited Notion client.
- AuditRun logs and action records keep success, warnings, failures, and replay state.
Safeguards
Security controls that match the product's execution model.
OAuth lifecycle
Connect, refresh, revoke, disconnect, and pause dependent rules.
Token encryption
Notion OAuth tokens use AES-256-GCM at rest.
Minimal storage
Page IDs and watched values are stored; full Notion page bodies are avoided.
Tenant isolation
Dashboard reads use tenant scope and RLS; worker jobs verify tenant and workspace IDs.
Rate limits
Per-workspace token buckets honor Notion Retry-After behavior.
Replay safety
Idempotency keys prevent successful actions from being duplicated.
Reliability targets
Operational software needs measurable behavior.
Detection target<5 min P95 status change to execution start
Time to value<20 min guided first successful run
Run reliability target99%+ without unrecoverable error
Audit retention target90 days of run logs on all plans
Enterprise roadmap
What larger buyers will ask before rollout.
These are not required for the first agency wedge, but they are the right path as ClientFlow moves toward larger consultancies and operational teams.
Backups
Database backup and restore policy is an enterprise-readiness item.
Disaster recovery
Durable queues and idempotent replay reduce accepted-run loss after crashes.
Data residency
Regional residency options are roadmap items for larger buyers.
Incident response
Public incident process and customer notification policy are planned.
Status page
A public status page belongs with the first larger customer rollouts.
SOC 2 roadmap
Controls, evidence collection, vendor review, and audit readiness are the path.