Your feedback data stays yours.
FeedbackFlow is built multi-tenant from the database up and ships to self-host. Isolation, encryption, and least-privilege access are defaults — not add-ons.
Tenant isolation
Every record is scoped to a tenant ID and enforced at the query layer. One workspace can never read another's feedback, uploads, or settings.
Encrypted secrets
SMTP credentials and integration tokens are encrypted at rest. Tenant tokens are stored as hashes — only a prefix is ever shown back to you.
Least-privilege access
Six roles and a 30+ permission catalog with per-member overrides. People get exactly the access they need — no more.
Audit trail
Sensitive changes are recorded with actor, before/after state, IP, and user agent — so you can answer "who changed what, when".
Session & token auth
Dashboard access uses signed session cookies; the widget and API use scoped bearer tokens you can revoke at any time.
Self-hosted by design
Run the Docker image against your own MongoDB. Pluggable storage (local, S3, or R2) means your uploads live where you decide.
How a submission travels.
A host site embeds the widget, which posts to the backend with a tenant token. The backend writes to your MongoDB; the dashboard reads it back over session-authenticated routes.
Widget in a Shadow DOM
Mounted in an isolated shadow root on your site, the widget collects context and submits with your tenant token over HTTPS.
Validated & scoped
Requests are rate-limited, schema-validated, and entitlement-checked, then written to your database under the tenant's namespace.
Read with permission
Team members read and act on the data through session-authenticated, permission-gated routes — never the raw token path.
You own the database.
Nothing is locked in a vendor's cloud. Point FeedbackFlow at your MongoDB, choose where uploads go, and back it all up on your schedule. Health checks and Docker make it production-ready out of the box.
- MongoDB with isolation-enforcing indexes
- Pluggable storage: local, Amazon S3, or Cloudflare R2
- Tenant-configurable SMTP with a managed fallback
- Health endpoint & container-ready deployment
# Bring up the full stack
docker-compose up -d
# App + MongoDB, health-checked
GET /api/health → 200 OK
# Your data, your storage
STORAGE_PROVIDER=s3
PLATFORM_ADMIN_EMAILS=you@co.comFound a vulnerability?
We take security reports seriously and respond quickly. Disclose responsibly and we'll work with you on a fix and timeline.
Security you can self-host.
Deploy on your own infrastructure and keep every byte of feedback in your control.