The program binds to 127.0.0.1 and opens no inbound ports at all. Only license validation and version updates go out, over an encrypted tunnel.
Account credentials are AES-256 encrypted before they touch disk, with the key bound to this machine's hardware ID. Move the files to another machine and they will not decrypt.
All of it over a Cloudflare named tunnel on HTTPS 443. The program binds to 127.0.0.1 and opens no inbound ports at all.
No tool can guarantee an account will not be restricted. What EngageFlow can do is keep every action measured.