Security & login
With the Cloudflare Turnstile integration, Armiflow protects the client portal against bots and automated requests. Turnstile usually checks requests unobtrusively in the background, while your clients sign in via magic link and work without annoying image puzzles.
Protection for the client portalUsually no puzzlesMagic link sign-inAlternative: reCAPTCHA
Sign-in verifiedExample · client portalCloudflare Turnstile is a Cloudflare service that detects automated access and usually does so without image puzzles. Armiflow uses Turnstile to protect the client portal, where your clients see orders, invoices, contracts and tickets. This keeps bots out of sign-in and forms. As an alternative, Armiflow supports reCAPTCHA; the app shows which service is active.
Benefits
Good bot protection is only noticed by those it is meant to stop. Cloudflare developed Turnstile with this goal: programs are detected, while people usually get through without an extra task.
Your clients open the portal to download an invoice, reread a contract or open a ticket. Every extra hurdle costs patience. That is why Turnstile relies on checks that normally run without any action from the client. Bots that request sign-in links in bulk or fill forms with spam, on the other hand, are stopped.
With Turnstile, too, technical data about the request is sent to the provider. Under the GDPR (EUR-Lex), clarify how you inform your clients about this, for example in your portal’s privacy policy. Whether Turnstile or reCAPTCHA suits you better often depends on which provider you prefer to work with.
At a glance
The key facts about the Cloudflare Turnstile integration in Armiflow, in short.
| Item | Details |
|---|---|
| Tool | Cloudflare Turnstile |
| Category | Security & login |
| Used in Armiflow | Client portal |
| What Armiflow does with it | Bot protection for the client portal, usually without puzzles for clients. |
| Status | Available |
| Credentials | Stored encrypted, roles and 2FA for your team |
| Approval | Customer emails and actions involving money only after your confirmation |
Connect
The app shows you whether you need your own Turnstile keys from Cloudflare or whether protection is already in place.
If required, you add the keys in Armiflow. They are stored encrypted.
Your clients sign in to the client portal via magic link, and Turnstile checks in the background.
Sign in as a test client and check sign-in and forms on both phone and computer.
Working together
Bot protection is one building block. These pages show the others.
Invoices, contracts and tickets for your clients, without a password.
Learn more →
An alternative way to protect the client portal.
Learn more →
Two-factor authentication for extra security.
Learn more →
Sign in to Armiflow with your Apple ID.
Learn more →
Security & data protection
Encrypted credentials. Whatever you store for Cloudflare Turnstile in Armiflow is encrypted. Every customer account has its own database schema and daily backups.
Team roles. With roles and two-factor sign-in you decide who on your team may use or change the Cloudflare Turnstile connection.
Your approval counts. Customer emails only go out after you approve them, and actions involving customers, money or deletion wait for your confirmation in the chat.
GDPR covered. Access and erasure under Art. 15 and 17, consent per channel and the public-authority filter apply to all data in Armiflow.
FAQ
Short, clear answers about this feature. Missing a question? Write to support@armiflow.com.
The Cloudflare Turnstile integration checks whether a request to the client portal comes from a person or from an automated program. Suspicious access, such as mass sign-in attempts or spam in forms, is stopped. Real clients usually get through without an extra task and work in the portal as usual.
Classic CAPTCHAs often ask users to click on images or type distorted letters. That takes time and is tedious on a phone. The Cloudflare Turnstile integration usually works without such puzzles and checks in the background. For a client portal that should be fast and convenient, that is a noticeable advantage.
The app shows you whether you need to connect Cloudflare Turnstile or whether protection is already active. If your own keys from Cloudflare are required, you add them in Armiflow, where they are stored encrypted. Turnstile then protects the client portal without your clients having to set anything up.
Turnstile can be used as a standalone service and does not require your entire website to run through Cloudflare. The app shows you whether your Armiflow account needs its own Cloudflare access. Your website and the Armiflow client portal are two separate things.
For the check, technical data about the request is sent to Cloudflare. Whether the Cloudflare Turnstile integration is used in a GDPR compliant way in your case is something to clarify with your data protection adviser, for example with regard to the data processing agreement. Name the service in your portal’s privacy policy.
Yes, the Cloudflare Turnstile integration is designed for all common browsers, including on smartphones and tablets. Because the service usually works without image puzzles, signing in to the client portal is comfortable on small screens. Still, test access yourself on a phone once before you invite your clients.
No. Turnstile keeps bots away, while two-factor authentication protects individual client accounts. In the client portal it is optional and adds a second proof to magic link sign-in, such as a code from an authenticator app. Bot protection and two-factor authentication together provide solid protection.
This rarely happens, for example with strict browser settings, ad blockers or unusual networks. Ask the client to reload the page, briefly disable extensions or use another browser. If that does not help, write to support@armiflow.com and describe the case.
Armiflow supports both services for protecting the client portal. The app shows you whether and how you can switch. If you connect Cloudflare Turnstile to Armiflow and change later, update your portal’s privacy policy afterwards and test sign-in again with a client account.
Turnstile protects the client portal, meaning access to orders, invoices, contracts and tickets. The app shows you exactly where the check applies, for example at sign-in or in forms. The aim of the Cloudflare Turnstile integration is that only real clients use the portal while bots stay out.
In everyday use, the Cloudflare Turnstile integration runs unobtrusively in the background. Your clients sign in via magic link, download invoices, read contracts and open tickets. Turnstile checks in the background. You only need to act if a client reports sign-in problems or you switch provider.
Turnstile is best looked after by a person with an admin role who is responsible for security and data protection. Staff in sales or accounting do not need any rights for this. With roles and custom roles, you determine who may change settings. Two-factor authentication additionally protects the admin accounts.
Test magic link sign-in on computer and phone, check whether Turnstile lets users through without hurdles, and see whether invoices, contracts and tickets are displayed correctly. Also review the privacy policy. Only when everything is in order should you invite your clients.
Typical mistakes are a missing note in the privacy policy, two checks active at the same time and no test with a real client account. Expired or incorrectly entered keys also occur. Keep it simple: one bot protection, clean keys, a clear privacy policy and a test run after every change.
According to the product description, Turnstile protects the client portal. Your own account in the Armiflow app is secured by two-factor authentication, roles, encrypted credentials and a separate database schema for each customer. The app shows you which additional checks apply to registration and sign-in in the app.
Your clients open support tickets via the portal or by email. In the portal, Turnstile keeps automated entries out, so your team only sees genuine requests. Tickets sent by email go through your mailbox, where your email provider’s spam filters keep things tidy.
Name Turnstile in your portal’s privacy policy, with provider, purpose and the data transferred. A short sentence is usually enough: the service protects the portal against misuse by automated programs. Write in plain language and, if in doubt, have the policy checked by your legal adviser.
Yes, because bots do not distinguish by size. Even a portal with only a few clients can become a target for spam or mass sign-in attempts. Turnstile prevents this without disturbing your clients. Small teams in particular save themselves from cleaning up spam tickets and answering questions about strange sign-in links.
Read on
Invoices, contracts, tickets, no password.
Learn more →
Protects the client portal from bots and automated requests.
Learn more →
Two-factor sign-in with codes from the authenticator app.
Learn more →
Sign up and sign in to Armiflow with your Apple ID.
Learn more →
Sign up in the app, choose an industry and a location and see your first results. Nothing is sent until you approve it.
Kodlogy Technologies GmbH
Kaiser-Ebersdorfer-Straße 81/2
1110 Wien, Österreich
+43 660 540 3636
support@armiflow.com
© 2026 Kodlogy Technologies GmbH. Alle Rechte vorbehalten.
