Skip to Content
ArchitectureOverview

Architecture Overview

FlowState is a multi-tenant SaaS application built on AWS, hosted in the EU (Frankfurt region).

How FlowState works

FlowState connects your HubSpot CRM to AWS Partner Central and provides AI-powered pipeline analysis on top of your deal data.

When you connect HubSpot, FlowState reads your deal pipeline on a schedule and in real time via OAuth webhooks. It runs AI analysis using AWS Bedrock to surface stalled deals, data quality gaps, win/loss patterns, and rep performance. Results are pushed to you through the web dashboard, email notifications, and via the Model Context Protocol (MCP) for direct integration with AI clients such as Claude. Slack is not currently a results-delivery channel — see Slack → Notifications for what the Slack integration does today.

For AWS Partners, FlowState also maintains a bidirectional sync between HubSpot deals and AWS Partner Central co-sell opportunities. Changes in HubSpot flow to Partner Central automatically, and status updates from AWS flow back to your HubSpot deal records.

Deployment

FlowState runs entirely on AWS in the eu-central-1 (Frankfurt) region. All client data is stored and processed in the EU. The one exception is the AWS Partner Central event handler, which must run in us-east-1 to receive Partner Central events — it processes data transiently in memory and writes results back to the EU. No client data is persisted outside the EU.

Multi-tenant isolation

Each FlowState tenant’s data is fully isolated. Credentials (per-tenant Secrets Manager paths) and data storage (per-tenant partition keys, IAM session tags) are scoped per tenant. A dedicated encryption key is created for every tenant and used for that tenant’s audit-archive data; other data stores are encrypted under a shared account-level key rather than a per-tenant one — see Security → Overview for the full picture. Access controls (IAM, RBAC, secret resource policies) are enforced independently of which key encrypts a given resource, and are what blocks cross-tenant access.

Integrations

  • HubSpot — OAuth connection, real-time webhooks, bidirectional deal sync
  • AWS Partner Central — cross-account IAM role, API-driven opportunity sync
  • Slack — a bring-your-own-Slack-app connection (the tenant creates their own Slack app from a FlowState-provided manifest and connects it), used today for on-demand status checks and a connection-test message — not an ongoing notification channel. See Slack → Overview.
  • Claude / MCP clients — full feature access via the Model Context Protocol

Identity and access

User authentication is handled by Amazon Cognito. Users sign in with email and password or Google SSO. Access to features within a tenant is controlled by roles (owner, admin, member, viewer) and a fine-grained permission system.

APIRoles