Enterprise

How Enterprise handles data

A factual description of the system as built. The contractual terms are in the Enterprise terms and the data processing agreement, which is in legal review.

Roles

For security events, your organization is the controller and PromptFlowEngine is the processor. For admin accounts and billing, PromptFlowEngine is the controller.

What is collected

  • Admins: email address, role, sign-in times. Sign-in uses one-time email links; there are no passwords.
  • Enrolled devices: a pseudonym for the person (HMAC-SHA-256 of the work email, keyed per organization; the email itself is not stored), the surface (browser, IDE, agent), and enrollment and last-seen times.
  • Security events: event kind (detected, warned, blocked, redacted, submitted, optimized, template used), tool (for example ChatGPT or Cursor), counts per data category (for example “2 API keys”), injection-risk bucket, policy action and version, client version, and time.
  • Billing: handled by Stripe. PromptFlowEngine stores the subscription status, plan, and seat count, never card details.

What is never collected

Prompt text, code, file names or paths, page contents, URLs, and the detected values themselves. Scanning happens on the device. The event schema has no free-text field, and the server rejects any event that includes one.

Where it goes

  • Cloudflare Workers and D1 host the service and the database.
  • If your organization configures a webhook, events are delivered to your HTTPS endpoint, signed with HMAC-SHA256.
  • Resend sends sign-in links, enrollment codes, and “report ready” emails. These contain a link or code only.
  • Stripe processes payments.

Retention

  • Individual events: 30 days by default, configurable from 1 to 400 days.
  • Daily totals: 400 days by default, configurable from 30 to 1,100 days.
  • Undelivered webhook payloads: until delivered, or about 37 hours of retries; failed ones are deleted 7 days later.
  • Sign-in links expire after 15 minutes, enrollment codes after 10, sessions after 12 hours.
  • Organizations that never finish sign-up are deleted after 7 days.
  • Deleting an organization removes all of its data at once.

Security controls

  • Every query is scoped to the organization taken from the caller’s credential, and tests cover cross-organization access for every resource.
  • Role-based access: owner, admin, security analyst, billing.
  • Tokens, keys, and codes are stored as keyed hashes; webhook secrets are encrypted with AES-256-GCM.
  • Sessions are HttpOnly, Secure, SameSite=Strict cookies with an additional CSRF header check.
  • An audit log records administrative actions, sign-ins, enrollments, and report downloads.

Your rights and your employees’ rights

Owners can export all organization data as JSON and delete the organization from the console. Employees should direct requests to their employer, which controls the data; we assist as processor. Employers should tell employees what is monitored before enrolling them. The browser extension and VS Code show employees exactly what their organization sees when they connect.

Certification

PromptFlowEngine is not certified under ISO/IEC 27001 or SOC 2. Work toward ISO/IEC 27001 is under way; this page will change when a certificate is issued, not before.