Security and your data Tested before it runs. Kept to the minimum after.
Where your customers' data goes. The editor is hosted by us. Sessions run on our servers or yours.
| What | Hosted | On your servers |
|---|---|---|
| Where sessions run | On luftflow's servers; ask us where. | On your servers, answering your gateway directly. |
| PINs and typed answers | In the live session until it expires. Never logged. | In the session store on your network. Never logged. |
| Phone numbers | Used to run the session, masked in logs. | Stay on your network, masked before logs leave it. |
| Responses from your APIs | Pass through our servers to fill the screens. | Stay on your network. |
| Session logs | Screens, choices, masked numbers, call timings. Deleted after 30 days. | The same logs, sent to the editor. Deleted after 30 days. |
| Flows, versions, tests | Stored in the editor. | Stored in the editor; your runtime downloads what you put live. |
Tests live in the editor, so use made-up data in them, never real customers'.
Controls in the product. On every plan, at no extra cost.
- Roles
- Viewers look, editors change and stage, only admins go live or hold secrets.
- Failing tests stop a publish
- A version with errors or a failing test can't be published.
- Versions never change
- Frozen with the checks they passed; rolling back is one step.
- Two people to go live
- Require that whoever publishes can't also put it live.
- An audit log
- Every publish and deploy, with who, when and which checks passed.
- Staging apart from live
- Each with its own address, keys, variables and encrypted secrets.
- Logs keep little
- Numbers masked, typed answers left out, deleted after 30 days.
- Rehearsals write nothing
- A flow rehearsing beside your live service has its writes refused.
- Passkeys and single sign-on
- Require a passkey or second step for everyone on the team.
Last updated October 18, 2026.