Is FlowCrm safe?
FlowCrm adds a CRM overlay to WhatsApp Web and relays conversation data to its own FlowCrm servers.
On web.whatsapp.com the extension loads scripts that fetch its configuration from apiexpress.flowcrm.com.br, then sends CRM data from the page to that API and a vendor websocket using a stored bearer token. This matches the product's stated CRM purpose. The page-facing message bridge does not check message origin, so other scripts running in the WhatsApp page can read the stored vendor token.
Part of this rating comes from analysis signals we haven't published as detailed findings yet.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Where it sends data
Destinations our analysis observed FlowCrm contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- apiexpress.flowcrm.com.br
FlowCrm sends data to apiexpress.flowcrm.com.br. No other extension we have analysed sends data here.