Your data security is our top priority
At Flow Myna, trust and security are foundational to everything we build. We know you're entrusting us with your data, and we take that responsibility seriously. Last reviewed: October 2026.
Our commitments
Transparency
You deserve to know where your data is stored, processed, and how it's secured.
Privacy-first approach
We encourage you to remove or anonymize any personally identifying information (PII) that is not required for process analysis. Where possible, we scrub or redact sensitive fields while preserving data needed for meaningful insights.
Minimal access
Only essential systems or personnel have access to data needed for operations, and all access is secured.
Continuous improvement
As we grow, we will evaluate and adopt recognised security frameworks, certifications, and controls.
Key security controls
These are the controls in place today. We add a control here only once it is running and we can show it.
- All customer data is stored in UK- and EU-based infrastructure: the database in Amsterdam, Netherlands, and uploaded files in London, United Kingdom
- All traffic is encrypted with TLS 1.2+ through Cloudflare, which also provides DDoS protection and a web application firewall
- The database is encrypted at rest, and uploaded files are encrypted with AES-256
- Uploaded files are kept in versioned storage, so an accidental deletion can be recovered
- Every request is authorised on the server and denied by default, and each workspace is isolated from every other. An automated audit checks every API route against our documented access rules
- We never see or store your password: sign-in and credentials are handled by WorkOS
- Our team runs routine production queries through a read-only database role
- Errors in the app are reported to us straight away (Sentry, EU region), so problems are caught and fixed quickly
- We review the codebase for security issues ourselves; the most recent full review was in September 2026
Breach notification: if a breach affects personal data you have given us, we will tell you within 48 hours of becoming aware of it, as our Data Processing Addendum commits us to.
Data storage and processing
We use trusted third-party providers to deliver our service. Each is vetted for security and compliance and processes only the minimum data necessary.
Railway
Railway Trust CenterApplication hosting, environment management, and database hosting (PostgreSQL)
Railway is SOC 2 certified and supports a GDPR Data Processing Addendum for EU users. All user data including databases is encrypted at rest.
Anthropic API
Anthropic Trust CenterCopilot, data mapping, insights generation, and filter processing
Anthropic API powers all AI-driven features in our platform including the copilot, data ingestion mapping, and analytics. Anthropic does not use API data to train its models and maintains strict data handling policies. Processes data in the United States.
OpenAI API
OpenAI Trust CenterVoice transcription
OpenAI API provides voice-to-text transcription for the copilot voice input feature. OpenAI does not use API data to train its models and data storage for model improvement is disabled by default for API usage. Processes data in the United States.
AWS S3
AWS ComplianceObject storage for user-uploaded files and datasets
AWS S3 encrypts data at rest (AES-256) and in transit (TLS). Bucket access is restricted via IAM policies with presigned URLs for secure uploads. UK region (eu-west-2, London), covered by UK GDPR and the EU adequacy decision.
WorkOS
WorkOS SecurityUser authentication, identity management, and password storage
WorkOS is SOC 2 Type II certified and GDPR compliant. Handles secure password hashing, JWT token issuance, and session management. Processes data in the United States.
Postmark
Postmark PrivacyEmail delivery for invitations, notifications, and updates
Postmark delivers transactional and product update emails on our behalf. SOC 2 Type II certified and GDPR compliant with EU data processing options.
Sentry
Sentry Trust CenterApplication error monitoring and alerting
Receives an error report when something fails in the app: the error and stack trace, the page and API endpoint involved, browser and operating system, and a pseudonymous user ID. Stored in Sentry's EU region (Frankfurt, Germany). No IP address is stored: where a report reaches Sentry straight from a browser, Sentry keeps an approximate location (country and city) derived from it, and a report relayed through our own API carries no visitor IP at all. No session recordings or cookies are used. Sentry is SOC 2 Type 2 and ISO 27001 certified, offers a GDPR Data Processing Addendum, and is certified under the EU-U.S. Data Privacy Framework.
Pydantic Logfire
Pydantic SecurityAI agent tracing and debugging
Receives traces of our AI agents' work (data mapping, copilot, insights) so we can diagnose wrong or slow answers. A trace includes the prompts sent to our AI providers and their responses, which can contain extracts of your uploaded data. Stored in Logfire's EU region. Logfire is SOC 2 Type 2 audited and covered by Pydantic's GDPR Data Processing Addendum.
Cloudflare
Cloudflare Trust HubDNS, CDN, and web application firewall
Cloudflare provides DNS resolution, content delivery, DDoS protection, and security headers. SOC 2 Type II and ISO 27001 certified. GDPR compliant with EU data processing options.
Plausible Analytics
Plausible PrivacyPrivacy-friendly website analytics
Plausible is a lightweight, cookie-free analytics tool. No personal data is collected, all stats are aggregated. GDPR, CCPA, and PECR compliant by design. EU-owned and hosted.
Important notes:
- •We send only the minimum data needed to each processor.
- •We do not store personal credentials or sensitive identifiers unencrypted.
- •Before a new provider starts processing customer data, we email everyone who has accepted our terms at least 30 days in advance, so you can object. To add another contact for these notices, email legal@flowmyna.com.
Data residency and location
We understand that data residency is critical for compliance. All customer data is currently stored in the UK and EU:
Core data storage
Amsterdam, Netherlands
Support for additional regions (US, APAC) can be provided as the platform scales and in response to customer data-residency requirements.
Supporting services
Observability, AI processing, and other supporting services may operate globally. If strict data residency is required for all processing, please discuss this with us.
Have specific data residency requirements? Contact us to discuss your compliance needs.
Your data, your controls
- You choose what you upload. We recommend removing personal data your analysis doesn't need before uploading it.
- You can delete a dataset or your account at any time. Process data is deleted within 30 days of account closure, and from backups within 90 days.
- When you leave, you can export your data (CSV or JSON) for 30 days. We confirm deletion in writing on request.
- We never use your data to train AI models, and our AI providers are contractually barred from doing so.
What we don't do
- We do not use third-party processors without careful evaluation.
- We do not use your data for marketing, cross-customer aggregation, or model training.
- We do not store backups outside secure, encrypted environments.
Future plans and certifications
As Flow Myna grows:
- →We plan to adopt standard security frameworks and pursue certifications (e.g. SOC 2, ISO 27001, ISO 27701).
- →We will continue expanding our transparency through regular security audits and compliance reporting.
- →We will continue improving our security practices as we grow and learn from industry best practices.
Common questions
- Do you train AI models on my data?
- No. We don't train models on your data, and the AI providers we use are contractually prohibited from using it for training or for anything other than providing our service.
- Where is my data stored?
- The database is in Amsterdam, Netherlands (EU), and uploaded files are in London, United Kingdom. Some supporting services, including AI processing, may run elsewhere; each provider and its location is listed above.
- Who can see my data?
- Members of your workspace, and the providers listed above, each for its stated purpose. Our own team accesses customer data only when needed to operate or support the service.
- Which AI providers see my data, and why?
- The ones listed above under Data storage and processing, with what each one does. We tell everyone who has accepted our terms at least 30 days before adding a new one.
- How do I delete my data?
- Delete datasets from your workspace, or close your account, at any time. See Your data, your controls above for how long deletion takes, including from backups.
- What happens if there is a breach?
- If a breach affects personal data you have given us, we will tell you within 48 hours of becoming aware of it, with what happened, what data was affected and what we are doing about it.
Legal entity and jurisdiction
Flow Myna Ltd is a company registered in the United Kingdom. Our data-handling practices follow the requirements of the UK GDPR and, where applicable, the EU GDPR.
Security and legal documents
Questions and reporting a vulnerability
For questions about our security practices, or to arrange anything custom, contact us at the address below.
Found a vulnerability? Email the same address. We will acknowledge your report, keep you updated on the fix, and ask that you give us reasonable time to fix it before disclosing it publicly. Our security.txt has the details.
security@flowmyna.com