Where AFOS data goes—and where it does not

Ordinary workspace path

• A user’s browser connects to the AFOS application over encrypted transport.
• The application authenticates an individual account and resolves its active organisation and role.
• Workspace data is stored in managed PostgreSQL with organisation-scoped access controls and tenant-isolation checks.
• Credentials for optional connectors are protected separately and are not returned to the browser after storage.
• Decision records retain integrity evidence while account identity is held separately so lifecycle controls can be applied.

Payments and email

Stripe hosts card entry and subscription checkout. AFOS receives billing identifiers and subscription status; it does not receive or store the full card number.

The configured transactional-email provider receives the address and message required to deliver account verification, invitations, security notices and service communications.

AI processing is invoked, not ambient

When an authorised user explicitly invokes a reasoning feature, AFOS sends the bounded question, context and selected evidence required for that request to the disclosed model provider. The provider boundary is not described as local processing.

AFOS screens for common high-risk data indicators and preserves human authority, but no automated screen is complete. Customers remain responsible for minimising inputs and confirming they are authorised to process them.

Public-site measurement

Google Analytics is optional and remains off until a visitor accepts analytics. Google collection is suspended before login and throughout signed-in surfaces.

After that opt-in, AFOS also keeps a first-party funnel record containing random visitor/session identifiers, the public entry path, the referring hostname and coarse UTM fields. It deliberately excludes email addresses, IP addresses, user agents, full referrer URLs, query strings and customer content. Account, verification and billing milestones are recorded server-side without card details or workspace content.

What AFOS does not claim

• No claim of local-only, on-premises or customer-VPC deployment.
• No claim that third-party AI providers never process submitted material.
• No claim that human sign-off alone makes a workflow compliant.
• No claim of zero retention unless the applicable provider agreement and active configuration verify it.
• No claim that AFOS replaces a customer’s legal, security or procurement review.

Evidence available during a pilot review

Qualified pilot customers can request the current provider register, data-flow and security explanation, tenant-isolation evidence, retention controls, incident pathway and relevant contractual schedule. Any control that has not been independently verified is described as such.

Common questions