Explanation
Security and access control in FlowEngine
Sign-in, sessions, roles, access to documents and the checks on incoming files – including the current limits.
Last reviewed October 30, 2026 · Version 2026.10
This article describes how FlowEngine handles sign-in, the roles in your company and access to documents, and which checks incoming files go through. It describes the functions of the application. It does not describe how your installation is operated, for example server location, backups or encryption of stored data.
Sign-in#
You sign in with your email address and password. Passwords and two-factor authentication are managed by a central sign-in service; administrators see it in the security policies under Identity provider.
| Topic | Behavior |
|---|---|
| Password | at least eight characters; change it under Settings → Sign-in & security, reset it with Forgot password? on the sign-in page |
| Two-factor authentication | one-time codes from an authenticator app, plus recovery codes for emergencies. Each person sets it up for their own account. |
| Rejected sign-in | FlowEngine shows a general message and does not say which entry was wrong. The same message currently also appears for a removed account or a deactivated company. |
FlowEngine currently cannot require two-factor authentication for everyone in a company.
Sessions#
In the security policies, administrators set the maximum duration of a session and after how many minutes without activity it ends. The defaults are twelve hours and 60 minutes. The server checks both limits with every request, even if someone chose Remember me for 30 days. After that, a new sign-in is required.
Sign out ends the session in the browser in which you choose it.
Companies and roles#
Every account belongs to exactly one company. The server assigns every request to the company of the signed-in account; members and administrators get no access to documents of other companies.
| Role | Rights |
|---|---|
| Member | works with the documents and procurement processes they are responsible for |
| Administrator | sees and edits all documents of the company and manages members, security policies and further company settings |
When an administrator removes a member, that member's account is deactivated. An existing session is rejected with the next request.
System administrators of the operator#
System administrators belong to the operator of FlowEngine, not to your company. They create companies, activate and deactivate them and enable functions. Technically, they can open and edit the documents of all companies.
Access to documents#
Who sees and edits a document follows from the role and from the responsibility for the document:
| Relation to the document | Member | Administrator |
|---|---|---|
| responsible | see and edit | see and edit |
| submitted it or owns the related procurement process, but is not responsible | see only | see and edit |
| no relation | not visible | see and edit |
An approved document is read-only. If Company-wide document search for members is switched on in the security policies, members also find other people's documents when they add documents to their procurement processes; the results then show only master data such as file name, document number and supplier.
Some areas currently do not follow this rule:
- Offer comparisons are readable by everyone in the company, including the price breakdowns of the compared offers, if the function is enabled for your company. Everyone in the company can also delete them.
- Missing document reminders are visible to everyone in the company, also for procurement processes they may not open. Anyone can acknowledge a reminder for everyone with Zur Kenntnis genommen (acknowledged); this label is shown in German in the English interface as well.
Checks on incoming files#
FlowEngine checks every file, whether it arrives in the browser, with the mobile app, by email or through the document interface:
| Check | Effect |
|---|---|
| File type | FlowEngine determines the type from the content of the file, not from the file extension or from what the sender declares. Formats that are not permitted for the intake channel are rejected. |
| Size | Your company's Maximum upload size applies; in the browser and in the mobile app, at most 20 MB per file. |
| Malware | A virus scanner checks every file before FlowEngine creates a document from it. Detected malware is always rejected. With Strict Malware Scanning (the default), files are also rejected when the scanner is unreachable. |
| PDF processing | FlowEngine reads PDF files in separate processes with limited memory and limited run time, not in the main process of the application. |
Which formats are permitted is listed under Supported file formats per intake channel.
Further safeguards#
- Checks on the server: The interface hides functions you may not use. The actual protection, however, is that the server checks every action, also for addresses called directly.
- Exports: Administrators can switch off document exports with Allow Document Exports. This setting currently does not apply to reports from the offer comparison.
- Invitations: Under Allowed invitation domains, administrators limit invitations to your organization's domains.
- AI providers: With Allow own AI providers, administrators decide whether your company may store its own AI provider. FlowEngine stores API keys encrypted and does not show them again.
- Traceability: The Security policies page shows administrators recent sign-ins as well as account and invitation events. The document history shows editing steps on a document; it currently does not record deleted fields and newly created line items.
What this article does not cover#
Server location, encryption of stored data and of connections, backups, retention periods and certifications depend on how your installation is operated and on your contract. Please contact your FlowEngine representative for these. Which data FlowEngine passes to which services for document processing is described in Data processing and AI features.