Reference
Security
How SignalFlare handles your Cloudflare tokens, your data and access within your team.
Two tokens, two trust levels
| Read-only token | Write token | |
|---|---|---|
| Needed for | Watching spend | Hard caps only |
| Scope | Account Analytics: Read | Only the write scopes for the actions you arm |
| Used when | Every poll | A cap runs, a dry run is tested, or you restore |
| Who can add it | Any member | Owners and admins |
Both are encrypted at rest with AES-256-GCM, decrypted only in memory, never logged, and never returned by the API after you paste them.
Caps are deliberate
Caps are opt-in per action, born as dry runs, armed only with a typed confirmation by an owner or admin, and fully audited with Cloudflare’s raw responses. Every change can be restored.
Your data
We store usage numbers, budgets, alert history and the configuration you give us. We don’t read your code, your traffic or your customers’ data. Webhook URLs are masked and signing secrets are never shown again after you save them.
Export everything from Settings → Export data. Delete your organization from Settings → Danger zone, which removes your data and cancels any subscription.
Infrastructure
SignalFlare runs on Cloudflare Workers and D1. The API sends strict security headers, accepts browser requests only from our own origins, and rate-limits sensitive routes. Payments are handled by Stripe; we never see card numbers.
Reporting a vulnerability
Email hello@signalflare.dev with details. We’ll respond quickly and credit you if you’d like.