SECURITY
Locked down, and honest about it
The cockpit reads work you care about, so its security posture is written down where you can read it. Everything below is what exists today, not what is planned.
WHERE IT LIVES
Every leg we place is in the EU
Residency stated for one leg of a journey is worth nothing. This is the whole path your work takes through FlowPilots, with the region each leg runs in.
THE STORE EU Frankfurt
THE COMPUTE OVER IT EU Frankfurt
THE MODEL THAT READS IT EU by default
PRODUCT ANALYTICS EU Frankfurt
Recorded as of 30 July 2026. Every leg above is a decision of record, not a marketing claim.
One leg is not ours to place. The tools you connect run where their own providers run them, so we do not count that leg as ours. What the cockpit keeps from what it reads is stored in the EU, on the path above.
The promise is scoped on purpose: it covers your accounts, your messages, and the model that reads them. Your data never trains any model, ours or anyone else's, and disconnecting a tool purges what it ingested. The CRM we run our own sales on is a separate system on an EU portal; we hold it to the same standard, and we do not stretch this promise to cover it.
Organizational practices
FlowPilots is founder-led. Exactly one person holds production access, and production credentials live in a managed vault, never on disk and never in the repository.
Secret scanning runs before every commit; dependency versions are locked by the lockfile and updated deliberately.
There is no SOC 2 badge here, because none has been earned yet. A formal certification program starts when the team grows; until then this page lists what actually exists.
Encryption and isolation
Data is encrypted in transit (TLS) and at rest in the database.
Every organization is isolated at the database layer, and database tests assert that isolation on every table.
Your data is never sold, never shared for advertising, and never used to train any model.
The approve gate and the audit trail
Nothing that acts outside the cockpit runs without your in-app approval: no send, no post, no settings change. Approvals are per-action and never generalized.
Every account action is logged today; when agent actions ship they land on the same immutable trail, with the tool, its inputs, and the covering approval attached.
You can disconnect any connection instantly, and disconnecting purges what it ingested.
Prompt-injection defense
Content read from a connected tool is data, never instructions. It travels in a separate channel from the instructions the cockpit runs on, and every item carries a record of where it came from.
Reading untrusted content can never by itself invoke an action: every write requires a fresh approval that only you can mint from the app.
Inbound connector content is screened for instruction-like payloads on ingest; anything flagged is quarantined with the reason recorded, never acted on.
Credentials and secrets
FlowPilots never sees or stores your passwords or 2FA codes for connected tools. Sign-in to each tool happens with the provider, and the cockpit holds only tokenized references it can revoke.
Connectors are read-only wherever the job allows and request the narrowest scope that works.
The vendors under the cockpit
Vercel hosts the application, with the functions that read your data pinned to Frankfurt. Supabase runs the Postgres database, in Frankfurt.
When AI processing ships, it runs on an EU inference endpoint under FlowPilots' own server-side keys, and your data is never used for training.
Cloudflare Turnstile screens the waitlist form for bots. Proton handles company email.
Sentry (errors) and PostHog (product telemetry, EU Cloud behind a first-party proxy) run only where we have turned them on.
Found a weakness?
Good-faith security research is welcome. The scope, the rules, and the safe harbor are in the responsible disclosure policy, and reports go to security@flowpilots.io.