Trust

Your connectionsstay yours.

What protects your data today, what we have not done yet, and who else touches it. No badge we have not earned.

Request our DPASee who else touches your data

What is in place today, and what is not

Seven things are live. One is planned, and we say so.

Credentials are encrypted before they are savedAES-256-GCM, with a key held outside the database.
In place
Each workspace's data is separatedRow-level security in the database keeps one workspace from reading another's.
In place
We never hold your password for sign-in appsGmail, Google and others connect with OAuth, so a token is stored, not a password.
In place
Moving from Make asks for read-only accessPausing your old bots is a separate permission you choose. You can remove the connection from Make at any time.
In place
Everything travels encryptedTLS between you, OpFlow and the apps you connect.
In place
Platform admin actions are loggedWho did what, and when, is kept for the operators of OpFlow.
In place
Audit log for your own team, with exportOwners and Admins can read who changed what in their workspace, and export it. Scale looks back a full year.
In place
SOC 2 reportPlanned. We have not started an audit, and we will say when we do.
Planned
0
of 8 in place today

Seven live, one planned. If a customer needs something on the planned list, tell us before you buy and we will say whether we can meet it.

How a connection is handled.

From the moment you add it to the moment you remove it.

You connect an app

With OAuth when the app offers it, or an API key when it does not. You choose the account.

It is encrypted at once

The credential is encrypted with AES-256-GCM before it is stored. It is never shown again.

Only your bots use it

A bot reads it for one step at the moment it runs. Shared connections stay with their owner.

Remove it any time

Delete the connection and the stored credential is deleted with it.

Who else touches your data.

The services OpFlow runs on. An AI provider whose key you give an AI step is your own choice and is not on this list.

ServiceWhat it does for OpFlowWhere
CloudflareHosting, the edge network, and the run engineGlobal edge
SupabaseDatabase, sign-in and file storageUnited States (us-west-1)
StripePayments and invoicesUnited States
AnthropicThe AI behind the assistant, the agent builder and AI steps that use OpFlow's model accessUnited States
Lovable AI gatewayRoutes AI requests when an AI step uses the built-in modelUnited States
GoogleSign in with Google, and the mail we send from OpFlowUnited States

Need our DPA or a security questionnaire?

We send the data processing addendum the same working day, and answer security questions in writing. If something you need is on the planned list, we tell you plainly.

Request the DPAAsk a security question