Security & data
FlowMock is a proxy. It works whether or not it stores a single value — so you can turn storage down to nothing and still mock, transform, and run scenarios.
Most tools in this space ask you to trust them with a copy of your staging traffic and then offer you a delete button. FlowMock inverts that: redaction happens at capture time, before anything is written. A redacted field was never stored, so there is nothing to delete, nothing to leak, and nothing to explain in a breach notification.
Set the project's bias once. Store everything is right when your staging traffic is synthetic — captured values are kept in full and you name the exceptions. Redact by default is right when staging can contain real or regulated data — every field value is masked at capture and you allow-list the safe ones like id or status. Change your mind later; the setting applies going forward.
Write a bare field name — email, token, oib — and it matches everywhere it appears in the tree. Scope each rule to query params, request body, response body, or all three. Project-wide rules cover every endpoint; per-endpoint rules live on that endpoint and override the default for that route alone.
Redaction applies only to intercepted upstream traffic. Mocks, transforms and scenarios you author yourself are stored exactly as typed — they're your test data, not your users'.
Proxying, mocking, transforms, scenarios, session isolation, the endpoint catalogue, and the generated contracts. What you lose is the ability to read historical values in Traffic and to build a mock from a captured body — you type the body instead. For a regulated team that's a fair trade, and it's a trade you can make per project rather than per company.
Every meaningful action across the organization, kept for 90 days: who invited whom, who activated which scenario in which session, who edited or published which override, who changed a session's delay. Filter by member, activity type, project, or time range.
This is the block that answers “how do we know a tester didn't leave a mock on during the demo” — you can name the person, the mock, and the minute.
| Control | Where | Options |
|---|---|---|
| Capture redaction | Project settings → Redaction, and per endpoint | Store everything / Redact by default + field rules |
| Log retention | Org settings → General | Org-wide default and maximum across all projects |
| Mock auto-pause | Org settings, overridable per project and per person | Session mocks switch off after a set period of dashboard inactivity |
| Audit log | Org settings → Audit log | 90 days, filterable |
| Members and invitations | Org settings → Members | Role-based, invitation-only |
| API keys | Org settings → API keys | Scoped bearer tokens for CI |
| Upstream domain verification | Org settings → Domains | DNS or HTTPS proof; unverified upstreams stay sandbox-limited |
FlowMock will not let an account point unlimited traffic at a domain it hasn't proven it controls. Unverified upstreams run under sandbox limits until you complete a DNS or HTTPS proof. One verification covers the registrable domain and its subdomains — in practice, one proof unlocks every environment you'll ever create against that API. It's a small friction on your first day that stops FlowMock being usable as an open relay against someone else's API, including yours.
Need this in writing for a review? Get in touch.