Private APIs require an authenticated session.
Signed-out reviewed private API requests returned 401; source tests passed.
VERIFIED PRODUCT BOUNDARY
Marketing is public. Flooring-company records are not.
The public Florz website is a separate static surface. The application requires secure sign-in, and reviewed private records derive company scope from the verified session.
Evidence register reviewed 2026-08-27. No certification or compliance framework is implied.
PUBLIC CLAIMS WITH EVIDENCE
Four claims are published because the reviewed boundary supports them.
Private records are company-scoped through the verified session.
Server-side session identity is used; hard-coded company identifiers and untrusted browser identity headers are rejected.
Scoped public links use expiry or single-use controls where appropriate.
Estimate, invitation, reset, and completion workflows were reviewed; an invalid estimate token returned a generic 404.
The marketing website and authenticated application are separate surfaces.
Static public content is served independently from app.florz.ca session and tenant-data workflows.
WHAT THIS PAGE DOES NOT CLAIM
Security language should be precise—not decorative.
Florz does not use this page to imply audits, certifications or guarantees that have not been completed.
- No certification claim
- No performance or uptime guarantee
- No public access to the Measure engine
- No assumption that every account receives every feature
- No claim that a static audit replaces ongoing operational security
RETURNING USER?
Open the authenticated Florz sign-in page.
The link hands off to app.florz.ca/login. It does not expose the application through the marketing website.