The short version
FlowRail is a security gate for AI coding agents. To do its job it has to read the code your agent is about to write, so yes, your code leaves your machine. This page is the plain-English version of what that means, scoped to what the product actually does today.
- Code is sent over HTTPS to api.flowrail.ai and on to one LLM provider for verification and design review. It is processed in memory and comes back as a verdict.
- FlowRail's database never stores your source code or your spec text. Event rows hold metadata, SHA-256 fingerprints, and the verdicts.
- No product analytics, no marketing pixels, no ad tech, no data brokers. FlowRail does not train models on your code.
- Workspace API keys and dashboard tokens are stored as SHA-256 hashes, not as raw secrets.
- Ask, and everything attributable to your workspace is deleted within 24 hours.
What leaves your machine, and when
FlowRail runs as hooks inside your coding agent. Each hook fires on a specific tool call. There are no background jobs, and nothing is uploaded on a timer.
| Trigger | What is sent | Where it goes |
|---|---|---|
| Your agent writes or edits a code file | The post-edit file content, its path, and the active design-review id | api.flowrail.ai, then one LLM provider |
| Your agent runs a design review on a spec | The spec text plus coarse repo signals: language and framework hints drawn from filenames and package names, never from file contents | api.flowrail.ai, then one LLM provider |
| Your agent runs an npm or pip install | The resolved package list as name/version pairs, plus the active design-review id | api.flowrail.ai; a local dry-run also resolves names against whichever package registry your machine is configured to use |
| A pinned secret pattern matches on a write | A detection id, the file path, the pattern id, and the line number | api.flowrail.ai. The matched secret itself is never transmitted |
| A destructive infrastructure call is blocked | The tool, HTTP method, host, path, and which signals matched | api.flowrail.ai. The raw command, request body, headers, and query string are never sent |
| Your agent asks for the audit lineage | The design-review id only | api.flowrail.ai (no LLM call) |
Every request carries your workspace bearer token, so activity is attributed to your workspace and only your workspace.
What we store
Events land in one Postgres table. These columns are the entire surface, and there is no code column in the schema to leak.
| Event | Persisted | Not persisted |
|---|---|---|
| Design review completed | Review id, spec path, SHA-256 of the spec, the predicted threat list, approved dependencies, channel allowlist | The spec text |
| Verification completed | Verification id, file path, SHA-256 of the content, pass/fail status, per-guardrail verdicts with a short reason summary | The file content |
| Dependency install checked | Check id, the resolved package list (name, version, registry URL), the allow/block verdict, which signals fired | Nothing |
| Secret detected | Detection id, file path, pattern id, line number | The matched secret string |
| Destructive API blocked | Block id, tool, method, host, path, matched signal kinds | The raw command, request body, headers, query string |
Content fields are SHA-256 fingerprints, not content. They answer one question (has this exact content been verified before?) and the original text is not recoverable from them.
Account data is separate and minimal: the email address and identity your sign-in provider hands us, your workspace membership, and your API key records. Key material is stored as a hash, so a database snapshot is not a credential dump.
How we use it
- To return a verdict to your agent, which is the entire point of the request.
- To build the audit lineage you see in the dashboard: which review, which threat, which guardrail, which decision.
- To enforce per-workspace quotas and catch abuse.
- To debug failures, using logs governed by the scrub rules described on the security page.
That's the complete list. We don't sell data, share it with advertisers or data brokers, build cross-site profiles, or run product analytics and marketing telemetry. FlowRail does not use your code to train models.
How long we keep it
| Data | Retention |
|---|---|
| Source code and spec text | Not retained. Held in memory for the length of the request, then gone. |
| Verifier cache | Verdicts only: status and per-guardrail results, never content. 60 seconds in the server process's memory, purged on restart, never written to disk. |
| Event rows (metadata, fingerprints, verdicts) | Kept for the life of the workspace, or until you ask for a wipe. |
| Account and API key records | Kept while the account is active. A revoked key stays as a hashed tombstone so the audit trail stays intact. |
| Server logs | Our hosting provider's default retention, a few days. We don't aggregate logs anywhere with longer retention. |
Who else touches the data
FlowRail runs on a short list of providers. Each is here because the product needs it, not because of a marketing integration.
| Provider | Why | What it sees |
|---|---|---|
| LLM provider | Runs the verification and design-review passes | Your file or spec content, for the length of the request. The default backend is Anthropic-hosted; a deployment can be configured against an OpenAI-compatible endpoint such as OpenRouter instead. |
| Neon | Hosts the Postgres event store (US East) | Event rows: metadata, SHA-256 fingerprints, verdicts. Never source code. |
| Fly.io | Runs the API server and this website (region iad) | Request traffic and application logs. |
| Clerk | Authenticates sign-in to the dashboard | Your email address and session. |
| Sentry | Error monitoring, only when a deployment has it configured | Exception traces, passed through the same credential scrubber as our logs. |
If you need this list inside a vendor questionnaire, write to us and we'll fill it in directly.
Your choices
- Wipe: email us and every event row, dashboard token, and stored contact detail attributable to your workspace is deleted within 24 hours; the API key is deactivated and kept only as a hashed tombstone.
- Access: your event history is visible in the dashboard, and the lineage skill returns it from inside the agent.
- Self-host: run the same container image on your own infrastructure, with your own database and your own model key, and our shared server never sees your code.
- Turn it off: FlowRail only runs through the hooks the installer writes into your repo. Remove them and nothing is sent.
Changes and contact
We update this page when the product changes and move the date at the top. Material changes get an email to workspace owners.
Questions, wipe requests, and vendor-review paperwork go to hello@flowrail.ai. Security reports have their own process. See the security page.