Open workspace
Trust by design

See what happens to every answer.

FormFlow makes privacy, AI confidence, evidence, and human control visible—not hidden behind a security badge or an unqualified certification claim.

Inspect the workspace View the data flow
Product truthClaims stay qualified until independently verified.
  • No invented certification
  • No silent submission
  • No training claim without evidence
Private production data flow

One visible chain of custody.

The signed-in workspace exposes the status of every required control. Real-data upload remains technically blocked until the VPS, billing, backup, restore, scanner, and monitoring checks pass.

  1. 01
    Receive

    Send the file directly to the private VPS, validate its real format and size, then quarantine and malware-scan it.

  2. 02
    Understand

    Encrypt clean bytes with a per-document key, then run OCR and structured extraction through the local model.

  3. 03
    Verify

    Match sources, apply rules, flag conflicts, and request missing information.

  4. 04
    Approve

    Show every answer and source to an authorised person before export or submission.

  5. 05
    Retain or delete

    Apply the user’s vault, regional, retention, and deletion choices.

Encryption boundaries

TLS protects data in transit. Each stored document uses its own disposable AES-256-GCM data key, wrapped by the VPS master key.

Human review

Every suggested answer exposes its source and confirmation state. Consequential information is not silently submitted.

Short-lived access

ChatGPT sign-in produces a three-minute signed claim. Every API request rechecks workspace ownership before returning private data.

Deletion controls

Deleting a document removes its encrypted bytes and wrapped key. Account export and delayed verified deletion requests run as audited private jobs.

Private processing

PostgreSQL, quarantine, malware scanning, OCR, document storage, and the local AI model run inside the VPS boundary.

Audit evidence

Security-relevant actions are appended to a hash-chained audit log that rejects update and delete operations.

Current release boundary

The public site does not accept documents or display customer records. The private control plane and VPS implementation exist in code, but real customer use stays locked until pilot identities, the actual server, secrets, scanner, local model, workers, Stripe catalogue and webhook, backup restore, monitoring, independent security review, privacy terms, and incident drill are verified. FormFlow is not claiming SOC 2 certification or legal compliance before independent audit and counsel review.