Trust & Compliance
PromptFloe · Last updated June 26, 2026
Security and privacy underpin everything we build at PromptFloe. This page describes the documents we can share, the sub-processors that handle data on our behalf, and the practices that protect your work. We publish only what is true today and clearly mark what is in progress.
01 Documents
How PromptFloe collects, uses, and protects personal data.
The terms that govern your use of PromptFloe.
The third-party services that process data on our behalf, by category and region.
GDPR Art. 28 / DPDP processor terms, with SCCs annexed. Counter-signable for any organization.
Our Schrems II assessment for India and US data transfers, available to support your own transfer process.
Independent attestation of our security controls. Engagement underway; report shared under NDA when issued.
Information security management certification. Planned after SOC 2; shares the same control base.
Paid compliance add-on for eligible Team-plan organizations handling US health data. Submit a request to discuss scope.
We respond to standard security questionnaires (CAIQ / SIG) for organizations in procurement.
02 Security practices
Encryption
Data is encrypted in transit with TLS. Sensitive credentials such as OAuth tokens and webhook payloads are encrypted at rest with AES-256-GCM.
Access control
Workspace access is role-based (Owner / Admin / Member / Viewer). Internal service-to-service calls are authenticated with a shared secret using constant-time comparison.
Application security
We enforce CSRF protection, a strict Content-Security-Policy, HSTS, and rate limiting on authentication endpoints.
Monitoring
Errors and performance are monitored via Sentry and OpenTelemetry, and administrative actions are audit-logged.
Data residency
Primary application data is stored in India (AWS ap-south-1). LLM processing occurs in the US (Anthropic, OpenAI, and Google).
03 Sub-processors
We engage the third parties below to operate PromptFloe. We give customers under a DPA prior notice of material changes. To subscribe to change notices, email support@promptfloe.com.
04 Contact
Privacy & data requests: support@promptfloe.com
Security & vulnerability reports: support@promptfloe.com
Grievance Officer (DPDP Act, 2023): named contact available on request.