Subprocessors

Data Received

• User accounts and authentication
• Organization settings and membership
• AI conversation logs and metadata
• Automation rules and execution history
• Encrypted FPT credentials (AES-256-GCM)

Data Classification

• Persistent — retained while account is active
• Row-Level Security enforces org isolation
• SOC 2 Type II compliant
• All data encrypted at rest and in transit

Data Region

• US East (Virginia)
• All data at rest resides in this region

Retention After Cancellation

• Account data permanently deleted upon account deletion request via cascade delete
• Encrypted FPT credentials deleted immediately on disconnection

Data Received

• Natural language queries (anonymized)
• FPT schema metadata (entity types, field names)
• API capability descriptions

Not received: production FPT data, credentials, or file contents

Data Classification

• Transient — Anthropic may retain inputs for up to 7 days per their API terms
• Not used for model training under API terms
• Client project names anonymized via AI Privacy Mode

Data Region

• US (API requests processed in the United States)

Retention After Cancellation

• No persistent data stored by Anthropic on our behalf
• Transient API data subject to Anthropic’s 7-day retention window

Data Received

• Billing contact information (name, email)
• Payment method tokens (Stripe handles raw card data)
• Subscription status and plan information
• Invoice history

Data Classification

• Persistent — retained while subscription exists
• Raw payment card data never touches FlowPilot servers
• PCI DSS Level 1 compliant
• SOC 2 Type II compliant

Data Region

• US (primary processing in the United States)

Retention After Cancellation

• Billing records retained by Stripe per financial regulations
• Payment methods removed when subscription is cancelled

Data Received

• FPT webhook event payloads (entity changes, status updates)
• Task and shot metadata (names, statuses, assignments)
• Automation rule execution context
• Log archives (application logs and security events archived from Grafana Cloud Loki for long-term retention)

Not received: user credentials, file contents, or media assets

Data Classification

• Transient — event payloads processed and discarded
• No persistent FPT data stored on AWS infrastructure
• Log archives: 90 days S3 Standard + 365 days S3 Glacier (455 total), Object Lock compliance mode (tamper-proof)
• SOC 2 Type II and ISO 27001 compliant

Data Region

• US East (us-east-1, N. Virginia)
• EC2 instances in a single region, no cross-region replication

Retention After Cancellation

• No persistent customer data stored
• Webhook processing stops immediately when automations are disabled

Data Received

• HTTP requests and responses (application traffic)
• Serverless function execution (API routes)
• Deployment artifacts (application code, not customer data)
• Environment secrets (encryption keys, API keys)

Data Classification

• Transit — requests pass through, not stored
• Environment secrets stored encrypted at rest
• SOC 2 Type II compliant
• All traffic encrypted in transit (TLS 1.2+)

Data Region

• US East (iad1, Washington D.C.) for serverless functions
• Global edge network for static assets and TLS termination

Retention After Cancellation

• No customer data persisted by Vercel
• Application deployments removed when account is closed

Data Received

• Application logs (request metadata, error traces)
• Structured security events (IP addresses, user agent strings, user/org UUIDs, event types, timestamps)
• Infrastructure logs (systemd journals, NGINX access/error logs)

Not received: FPT production data, user credentials, personal data beyond IP addresses, email addresses

Data Classification

• Persistent — 14-day retention in Grafana Cloud Loki
• SOC 2 Type II compliant

Data Region

• US (Grafana Cloud)

Retention

• 14 days in Grafana Cloud Loki (real-time querying)
• Additionally archived to AWS S3 for 455 days (90 days S3 Standard + 365 days S3 Glacier, tamper-proof via Object Lock — see AWS section)

Data Processing Agreement

Our Data Processing Agreement (DPA) covers FlowPilot’s use of the subprocessors listed on this page, including processing details, security measures, and your audit rights. A downloadable PDF is available from the DPA page.

Change Notification

We will provide at least 30 days’ notice before adding new subprocessors or making material changes to existing ones. Notifications will be sent to the billing email address on file for your organization.