Skip to content

Security at Fluvial

For: administrators, prospective customers

Your drawings and reports are commercial IP and contractual records. Here's how Fluvial protects them.

Encrypted, on proven infrastructure

Fluvial runs on Amazon Web Services (AWS). Documents are stored in AWS's S3 storage service — the same infrastructure trusted for banking and government workloads — with encryption in transit (all traffic over HTTPS/TLS) and at rest.

Sign-in, not passwords we invent

Authentication is handled by AWS Cognito. Fluvial's own servers never store or handle your password. Access within your account is role-based (admin vs member), and departed staff are disabled in one click.

Recipients access documents through unique, private links:

  • Each link contains a 256-bit cryptographically random token — unguessable in practice.
  • Tokens are stored hashed, the same way responsible services store passwords — a breach of the database alone can't be used to access stored files.
  • Links are revocable, share links additionally expire after 30 days, and an invalid or revoked link reveals nothing about what it used to point to.

An audit trail nobody can edit

Every significant action — uploads, edits, approvals, issues, downloads — is recorded in an append-only audit trail. Issued transmittals are immutable snapshots. Together they make your records defensible: what was issued, to whom, when, approved by whom — permanently.

Payments

Card details go directly to Stripe, a certified PCI-DSS Level 1 payment processor. Fluvial never sees or stores your card number.

Questions?

For security questions beyond this page — assessments, questionnaires, specific controls — contact support@efficussoftware.com.