Compliance — GDPR

Data residency

All FlowState data is stored and processed in eu-central-1 (Frankfurt, Germany). This applies to:

• DynamoDB (all operational data, with the audit log held in a separate dedicated table)
• S3 (pipeline snapshots, audit log, export archives)
• Secrets Manager (per-tenant credentials and API keys)
• KMS (see Security → Overview for details on encryption key scope)
• SES (email sending — eu-central-1 endpoint)
• CloudWatch Logs and metrics

The one exception is the APN inbound handler, deployed in us-east-1 because the AWS Partner Central EventBridge bus is in that region. This Lambda processes APN event metadata transiently (in-memory only) and writes results back to eu-central-1. No APN data is persisted in us-east-1.

Right to access (Article 15)

Self-service export

Every FlowState user can request an export of their personal data.

1. There is no self-service “Export my data” button in the product UI today. The export must be triggered via the REST API or an MCP tool directly.
2. POST /v1/users/me/export (or MCP export_my_data()) starts the export and returns a job ID immediately.
3. GET /v1/users/me/export/{job_id} (or MCP get_my_export_status(job_id)) polls the job.
4. When the job completes, you receive an email telling you it is ready. The email does not contain a download link — sign in and call step 3 again (or ask an MCP-connected assistant to check) to receive a fresh, short-lived download URL.

What is included in the export

Not currently included: grants, API-key metadata, audit events, and the notification send log. If you need this data, it is not currently reachable through the self-service export.

Deal data, pipeline snapshots, and APN sync-state rows are tenant-level, not personal, data and are not part of this export. There is currently no separate tenant-level data export endpoint.

Export delivery

Your export is not delivered as a link in the email — a link long-lived enough to be useful days later cannot be signed safely by the service that prepares it (the signing credentials themselves do not last that long). Instead, poll the job status endpoint (or ask an MCP-connected assistant) whenever you are ready to download; each poll returns a fresh download URL valid for a short time. The underlying file in the export bucket is automatically deleted 7 days after it is written, whether or not you downloaded it.

Right to erasure (Article 17)

Self-service deletion

To delete your FlowState account:

1. Go to Account → Delete account (not “Privacy” — there is no Privacy section).
2. Type DELETE and confirm.

Via REST: DELETE /v1/users/me Via MCP: delete_my_account(confirm="DELETE") (case-insensitive; the handler lowercases and compares to "delete").

Block condition: If you are the current owner of an active (not soft-deleted) tenant, deletion is blocked with 409 OWNS_ACTIVE_TENANTS. You must first transfer ownership or soft-delete the tenant before deleting your account.

What erasure does today

When you delete your account, it is marked as deleted, disabled in the identity provider, and every token already issued to you is revoked. This blocks sign-in: a deleted account cannot authenticate again, and any session that was already open stops working as soon as its access token is next checked. FlowState does not currently guarantee that every associated record (for example, session bookkeeping rows, tenant memberships, and notification history) is deleted or anonymised as part of this action — that erasure is separate from, and does not block, the sign-in cutoff above. We are reviewing our account-deletion process to ensure it fully aligns with GDPR Article 17. If you need confirmation that specific personal data has been erased, or need a data category erased that isn’t covered by self-service deletion today, contact support@copebit.ch.

Data not deleted

• Audit events where you were the target (e.g., “user X invited user Y”) are retained for audit integrity. As of 2026-09-25, a new audit row identifies you by your account’s opaque sub identifier, never your email address — audit rows hold no PII by design. Audit rows written before that date may still carry the plaintext email address that was current at the time; those rows live in a COMPLIANCE-mode, Object-Locked archive with a fixed 2555-day (7-year) retention and cannot be retroactively edited or deleted, including on request — this is an accepted, documented exception to the “audit rows hold no PII” rule, not an oversight.
• SES does not retain email bodies past 14 days, and FlowState does not store email body content.

Data Processing Agreement (DPA)

For clients who require a formal DPA for GDPR Article 28 compliance, contact support at support@copebit.ch. FlowState uses AWS (Frankfurt) as the primary sub-processor. See the subprocessors list for the complete list.