Security

Flo only reads. It never writes to a connected source, never sends anything, never acts without a person.

Flo only reads

Flo never writes to a connected source. It never posts to Slack, never comments on GitHub, never edits a Notion page, never sends an email. It reads what your team already said, proposes changes to your Fluorine board, and waits for a person to confirm.

Nothing Flo does is one-way. Every applied change can be undone, and the full record of what was proposed, decided, and reversed stays in Drift.

What each source grants

Every connection asks for the smallest read permission that works. None asks for write access.

GitHub — installed as a GitHub App on the repositories you choose. Reads commits, pull requests, and issues on those repositories only. Cannot push, merge, comment, or see repositories you didn’t select.

Slack — a bot added to the channels you choose. Reads messages in those channels and the names of workspace members. Cannot read channels it hasn’t been added to, cannot read direct messages, cannot post.

Zoom — reads the transcripts of cloud recordings after a meeting ends. Does not join calls, does not record, does not see meetings without a cloud recording.

Google Meet — reads meeting transcripts saved to Drive. Does not join calls or record. Requires a Google Workspace plan that produces transcripts.

Notion — reads the pages you share with the integration. A page you haven’t shared is invisible. Cannot edit or create pages.

Granola — reads meeting notes from your Granola account. Read only.

Email — nobody grants mailbox access. Your workspace gets a private forwarding address, and Flo reads only what a workspace member forwards to it. Emails from non-members are dropped. Flo attributes the email to whoever forwarded it, because that is the identity it can verify.

Notes — written inside Fluorine by your team. Read the same way as every other source.

What Flo never does

Never writes to a connected source
Never sends anything — no messages, no emails, no comments
Never reads direct messages
Never joins or records a call
Never changes your board without a person confirming, unless you turn on automatic application yourself — and that’s off by default
Never creates a task without a person confirming
Never holds a credential it doesn’t need

Where your data lives

Source content Flo reads — messages, commit text, transcript lines — is stored so it can be cited as evidence. Connection credentials are encrypted at rest. Fluorine runs on Railway, with file uploads on Amazon S3 and transactional email through SendGrid. Detection runs on Anthropic’s API; the text Flo reads is sent there to be evaluated and is not used to train models. Errors are reported to Sentry with request bodies and database details stripped.

The full list of third parties that handle data is on the subprocessors page.

Who can see what

A workspace is private to its members. Owners and admins see every proposal. Members see proposals on tasks assigned to them. Nobody outside the workspace can see anything in it.

Disconnecting a source stops Flo reading it immediately. Existing evidence stays, so past proposals keep their citations.

Deleting your data

A workspace owner can delete the workspace from Settings. Deletion is queued for seven days, during which it can be cancelled, then everything in it is permanently removed: tasks, proposals, evidence, stored source content, and connection credentials. Flo only ever held a copy of what your tools already had.