Version 1.0 · In force since 21 October 2026
Data Processing Agreement
This agreement is part of the Terms of Service and governs the processing of personal data that FlowCensus Desenvolvimento de Software Não Customizável Ltda., Brazilian tax ID (CNPJ) 69.406.614/0001-74 (“FlowCensus”, processor), carries out on behalf of the Customer (controller) when providing the service. It meets Article 28 of Regulation (EU) 2016/679 (GDPR) and Brazil’s Law No. 13,709/2018 (LGPD). Where it conflicts with the Terms of Service, this agreement prevails on matters of personal data.
1. Subject matter, duration, nature and purpose
- Subject matter: census of the Customer’s automations, risk classification, provenance attribution and remediation measurement.
- Duration: for the term of the contract, plus the retention periods in Annex I.
- Nature: reading flow definitions through a read-only API or exported file; extracting structure; storing findings encrypted; displaying them on the platform.
- Purpose: enable the Customer to know, prioritize and fix the risks in its automations.
2. Personal data and data subjects
| Category of data subject | Data |
|---|---|
| Customer employees and contractors who build or maintain automations | Name, username and work email, as they appear in the structure and metadata of the flows |
| Platform users designated by the Customer | Name, work email, role, access logs |
Out of scope. FlowCensus does not process personal data of the Customer’s own customers, consumers or end users. The content of pinnedData is detected and counted but never stored. The raw flow JSON exists only in memory during the scan. Secret values are never stored, in any form. No special categories of data are processed.
3. FlowCensus obligations
FlowCensus:
- processes the data only on the Customer’s documented instructions — these terms and the settings made on the platform — and informs the Customer if an instruction appears to infringe the law;
- ensures that persons authorized to process the data are bound by confidentiality;
- implements the security measures in Annex II;
- engages subprocessors only under section 4;
- assists the Customer, as far as possible, in responding to data subject requests;
- assists the Customer with impact assessments and prior consultations related to the service;
- notifies incidents under section 6;
- deletes the data at the end of the contract under section 7;
- makes available the information needed to demonstrate compliance with this agreement and allows audits under section 8.
4. Subprocessors
The Customer gives general authorization for the subprocessors listed on the Subprocessors page. FlowCensus will email the Customer at least 30 days before adding or replacing a subprocessor that processes Customer data. The Customer may object on reasonable grounds within that period; if no solution is found, the Customer may terminate the contract and receive a pro-rata refund of the unused term.
FlowCensus imposes on each subprocessor data protection obligations equivalent to those in this agreement and remains liable to the Customer for their performance.
5. International transfers
Data is hosted on AWS, in the us-east-2 region (Ohio, United States).
- For data subject to the GDPR, the parties adopt the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, Module 2 (controller to processor), incorporated by reference, with the Annexes of this agreement as their annexes.
- For data subject to the LGPD, the parties adopt the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024), incorporated by reference.
6. Security incidents
FlowCensus will notify the Customer without undue delay, and within 48 hours of confirming an incident affecting Customer data, of what is known about the nature of the incident, the data and data subjects affected, the likely consequences and the measures taken. The information will be supplemented as it is established, so the Customer can meet the deadlines of European supervisory authorities and the ANPD.
7. Termination and deletion
At the end of the contract, FlowCensus drops the Customer’s dedicated database, deletes the data key, revokes the API key and issues a dated deletion certificate listing what was deleted and when. The event log, which contains no flow content, follows the period in Annex I. Backups expire within the period stated in Annex II.
8. Audits
FlowCensus answers the Customer’s reasonable security questionnaires and provides the relevant technical documentation. On-site audits, where required by law or by an authority, will be scheduled 30 days in advance, during business hours, under confidentiality and no more than once a year, except after an incident.
9. Customer responsibilities
The Customer warrants that it has a legal basis to submit the data to the service, informs its employees of the processing as required by law, and submits only instances it controls or is authorized to analyze.
Annex I — Details of processing
| Item | Description |
|---|---|
| Controller | The Customer, as identified at purchase |
| Processor | FlowCensus Desenvolvimento de Software Não Customizável Ltda., Rua Pais Leme, 215, Conj. 1713, Pinheiros, São Paulo – SP, CEP 05424-150, Brasil; data protection officer: Paulo R. Barbosa, privacy@flowcensus.com |
| Data subjects | Customer employees and contractors who build automations; platform users |
| Data | Name, username, work email, role, access logs |
| Special categories | None |
| Frequency | Continuous, at each scheduled or on-demand scan |
| Retention | Raw JSON: zero (memory only). Redacted excerpts: 90 days. Finding state: contract + 30 days. Event log: contract + 12 months, or less if the Customer decides. Access logs: 6 months |
Annex II — Technical and organizational measures
- Segregation: a dedicated PostgreSQL database for each Customer.
- Encryption at rest: database encrypted with a key managed in AWS KMS; descriptive fields (flow, node and credential names, locators, redacted excerpts) encrypted at field level with a data key unique to the Customer.
- Customer API key: envelope-encrypted with a per-Customer key wrapped by AWS KMS; never logged, never returned by the API.
- Encryption in transit: TLS 1.2 or higher on every external connection and to the database.
- Minimization: raw JSON, secret values and
pinnedDatacontent are never written; from executions, only status, time and mode. - Access control: mandatory multi-factor authentication; passwords stored with argon2id; administrative access without SSH, through a recorded channel; least privilege in cloud roles.
- Edge: CloudFront with a web application firewall, managed rules and per-IP rate limiting.
- Change management: infrastructure described as code, reviewed and applied by pipeline; daily drift detection.
- Backups: automatic encrypted database backups, retained for 14 days.
- Retention: scheduled and tested purge for each period in Annex I.
- Incidents: response and notification procedure under section 6.
Annex III — Subprocessors
Current list on the Subprocessors page.
This agreement is also available in Portuguese. In case of conflict, the Portuguese version prevails for customers in Brazil.