Security

A plain description of how Flowcall protects your data, written so you can forward it to your IT team. Everything here describes what the software does today. Flowcall has not yet had an outside security audit or penetration test.

Where your data lives

• Flowcall runs on your own Windows PC (or your own server). Pipelines, files, results, decisions and logs are kept in a folder on that computer.
• We never receive that data. There is no Flowcall cloud that holds it.
• Flowcall sends no usage data or telemetry. It doesn't check for updates by itself.
• The only thing that reaches our servers is the licence check of a paid plan: about once a day, the licence's identifier and the Flowcall version number. The free Starter plan makes no licence check.

What leaves your computer, and only if you set it up

• Your own connections. The steps you build talk to the services you point them at: your database, an API you call, a mailbox you read.
• Email alerts. If you switch them on, they go out through the email server you choose.
• A cloud assistant. The assistant is off until you set it up. If you choose Hugging Face or Anthropic, Flowcall sends that provider your question with what it needs to answer: pipeline code, table and column names, run logs and test-run output (which can include values your steps print), any picture you paste, and the notes you wrote under "Teach the assistant". It never sends saved passwords. A model on your own computer or network keeps all of this inside your network. Hugging Face may pass the request to one of its partner providers to run the model.

Who can reach it

• Only your own computer, by default. Flowcall listens on 127.0.0.1, so other computers on the network cannot connect to it.
• It answers only to the names of your own computer. A web page that tries to reach it under another name is turned away.
• Server mode lets a team share one copy. It is switched on deliberately, and you list the address people use (the CADENCE_ALLOWED_HOSTS setting) so Flowcall answers to that name only. Put it behind HTTPS before using it beyond a trusted network.

Accounts and passwords

• Passwords are stored as scrypt hashes with a random salt, never as the password itself.
• After 5 wrong passwords from one address or for one username, sign-in is locked for 15 minutes.
• Sign-ins expire after 12 hours. Only a fingerprint of each sign-in token is stored, so a copy of the database can't be used to sign in.
• Every change made in the browser must carry a per-session security token, and requests from other websites are refused.
• Roles: owners manage people and settings, editors build pipelines and decide approvals, viewers look and download.

Saved passwords and keys

• Database passwords, API keys and other secrets are encrypted on disk. The key that unlocks them is in a file only your Windows account can read.
• Secrets are put into a step only while it runs, and they are blanked out of every log line before the log is saved.
• Saved passwords are never shown again in the app.

Inside the app

• A strict browser security policy: the app only runs its own scripts, can't be framed by other sites, and sends no referrer.
• An audit log records sign-ins, failed sign-ins, approvals and changes to people and settings.
• Editors can add Python and command steps, which run with your account's rights. Treat editor access like access to the computer. On a server, a hardened mode (CADENCE_DISABLE_SHELL) turns those step types off.

The installer

The installer is not code-signed yet, so Windows shows "Windows protected your PC" the first time. Each release publishes the file's SHA-256 checksum, so you can check the file is exactly the one we published. How to check it.

This website

This website has no cookies, no trackers, no analytics and no scripts. It loads nothing from other websites.

Reporting a security problem

Please report it privately rather than in public. Until a dedicated security address exists, use the contact page. Tell us the Flowcall version and the steps that show the problem.

The Privacy Policy lists exactly what we collect.