Security and privacy FAQ

Where is my data stored? Selecting a region in your settings does not move data. Contact Flowpane for current storage and processing locations before relying on a data-location requirement. See Data residency.

Is my data encrypted? Data in transit uses TLS. Deployment credentials (FTP and SFTP passwords) are encrypted at rest using encryption and are never returned to the browser once saved.

What does Flowpane fetch from my site? Only public resources: the governance files at their conventional paths, your homepage, your sitemaps, and, during a Deep Scan, pages reachable by following internal links. Flowpane never signs in to your site.

Can I delete my account? You can deactivate your account from Settings → Danger zone. Deactivation removes your ability to sign in but does not erase personal data or start a timed purge. To request erasure, email support@flowpane.com. See Danger zone.

Who can see my Sites? Every member of the Workspace that owns the Site, according to their role. There is no per-Site access control yet. Flowpane staff do not browse customer data as part of normal operation.

Does Flowpane sell my data? No. Flowpane does not sell or share your data with third parties.

Do report recipients need to consent? Yes. Anyone outside your Workspace who is added as a report recipient receives an invitation and must confirm before any report is sent to them. Every report email carries working unsubscribe and report-as-unsolicited links. See Report recipients.

Is two-factor authentication available? Not yet. See Security.