Security & Compliance

This page describes how Glow handles the data passing through it: what is retained and for how long, how it is encrypted, and where credentials live.

Certifications & Compliance

SOC 1

Glow holds a SOC 1 attestation, which covers controls relevant to financial reporting. If Glow sits inside a process your own auditors examine, this is the report they will want. It is not a security attestation: for that, see SOC 2 below. Your account team can supply the current report.

SOC 2

A SOC 2 audit is underway. For a SOC 2 report, talk to your account team: they can say where the audit stands and what evidence is available to share now.

GDPR

Glow acts as a data processor under the General Data Protection Regulation. The platform provides data export and the retention limits described below.

For a deletion request, work with your account team. A workspace holds more than its database rows — uploaded files and the authorisations you granted to reach your other systems are held separately. Your account team confirms removal across all of it and gives you that confirmation in writing, which is what an auditor asks for.

Data lifecycle and retention

Glow is an execution engine: it processes your data and keeps it only as long as running and debugging a workflow requires.

• Execution Logs: Payload data (inputs and outputs) passed through your workflows is retained strictly for debugging, then purged automatically. Run records and step-level payloads are purged 30 days after the run finishes, by default. Bounded retention limits exposure, but it also means Glow is not a system of record. If you need an audit trail of what your automations did, export it as it happens. Each run keeps the retention policy in effect when it started. Where a specific period is a compliance requirement, your account team can set a different one for your workspace. See System Limits.
• Temporary Files: Files a workflow fetches during a run (a PDF pulled from an email, say) live in isolated run storage. They are not added to your team’s file library and are not retained as durable storage.
• Personally Identifiable Information (PII): Glow acts as a data processor. PII passes through only where your workflow sends it, and is not indexed or stored beyond the execution logs above.

Data protection

• Encryption at Rest: All sensitive data, including your third-party API credentials, OAuth tokens, and stored workspace secrets, is encrypted at rest using industry-standard AES-256 encryption.
• Encryption in Transit: All communication with Glow web applications and API endpoints is encrypted in transit using TLS 1.2 or higher. Outbound requests from workflows to third-party services are sent over HTTPS.
• Credential Sandboxing: Your connected App credentials are never exposed to the end-user or the workflow canvas directly. The Glow execution engine injects them securely at runtime.

Hosting architecture

Glow runs as a multi-tenant cloud platform. Every workspace’s workflows, executions, files and variables are scoped to that workspace. Every request is checked against the workspace it names before any data is returned. Some access crosses a workspace boundary, such as an MSP operator reaching a client. That exists only where a delegation grant permits it, and is logged.

If you have a data-residency requirement, such as a specific region or a single-tenant deployment, raise it with your account team. Those are handled case by case, not by a setting in the product.

Third-Party Access

If a managed service provider administers your workspace, their operators hold a delegation grant. That is a separate, revocable permission, sitting outside the roles in Team Management.

You control its scope and duration. You are emailed whenever an operator acts as one of your admins, and any of your Admins can end it immediately. If a Partner Manages Your Workspace sets out exactly what each access tier permits, what it never permits, and how to revoke it.

What’s Next?

• Apply these controls to your own workspace in Team Management.
• See how sensitive values are stored and scoped in Secrets and Variables.