Your business data stays in your systems. We connect to your tools to build and configure automations, but we don't copy, download, or warehouse your data on our servers.
We connect to your tools through official APIs and OAuth authentication. We never ask for your passwords. You can see exactly what we have access to, and you can revoke it at any time.
All connections use TLS encryption in transit. Any credentials or API keys are stored in encrypted vaults during the project, not in spreadsheets or shared documents.
When we build an automation that moves data between your systems (say, from Xero to HubSpot), that data flows directly between those platforms. It doesn't pass through or get stored on FlowWorks infrastructure.
We operate under Australian privacy law and meet all obligations under the Privacy Act 1988. We can provide a data processing agreement for clients who need one for their own compliance requirements.
When a project is complete, we remove all API connections and access to your systems. If you're on an ongoing retainer, we maintain only the minimum access needed to support your automations.
You log into your tool (Xero, HubSpot, etc.) and grant FlowWorks permission through the platform's official OAuth flow. This is the same process you'd use to connect any app.
Using the API access you've granted, we configure the automation workflows. Data flows directly between your platforms. It doesn't route through or get stored on our servers.
You can see exactly what access we have at any time through your tool's connected apps settings. You can revoke access with one click, no questions asked.
When the project wraps up, we remove all API connections and delete any stored access tokens. If you're on a retainer, we keep only what's needed to support your automations.