Security & Compliance
Review Glow’s access controls, credential handling, and data lifecycle before processing sensitive data. Confirm contractual commitments and required audit evidence with your account team.
- Use it to
- Evaluate encryption, secret redaction, data retention, role boundaries, and SOC 1, SOC 2, or GDPR compliance requirements
- Find it
- Workspace menu → Members and invites, Variables, and Team settings → Governance
- Limits
- Default execution history retention: 30 days · Secret reveal window: 10 seconds (audited)
| Review area | Where to start |
|---|---|
| Roles, private automations, and delegated access | Permissions and Access |
| Credentials and destinations | Data protection |
| Stored results and connected services | Data lifecycle and retention |
| Audit evidence and contractual terms | Compliance review |
Data lifecycle and retention
Execution history has a default retention period of 30 days after a run finishes. Each run keeps the retention policy in effect when it started. Export records you need to retain before they expire, and confirm any required retention period with your account team. See System Limits.
Execution history is not the only place automation data can live. Review workspace files, variables, saved configuration, and the external services your Steps send data to. Do not assume that run-history expiry also deletes these resources or provider-held copies.
Data protection
- Workspace secrets and API keys: Encrypted before storage and hidden in the Variables table, with audited reveal and rotation by Admins and Managers. Automations decrypt values when resolving references; see Secrets and Variables.
- App connection credentials: Encrypted before storage, and connection details never return raw credentials. Review requested provider permissions before authorizing an account; see Credentials & Authentication.
- Step configuration secrets & automated redaction: Secret-marked app fields withhold sensitive content from collaborative editing.
SECRET_IN_UNSAFE_SINKblocks workspace secrets in AI prompts, Data Stores, files, and Subflow inputs. Runtime log redaction scrubs exact secret values and common encodings (JSON-escaped, URL-encoded, Base64, and hex for secrets 6+ characters) and withholds output if the secret list cannot be read. Because arbitrary script transformations remain best-effort to detect, keep raw credentials out of outputs. - Transport and storage security: Glow enforces HTTPS for external MCP servers and webhook endpoints and encrypts stored secrets, API keys, and connection credentials at rest. Contact your account team for architecture documentation covering TLS configurations, encryption standards, and key-management controls.
Access and deployment requirements
These checks are for your review only. They are not saved, and Glow does not verify or change your automation.
Review workspace roles, Public automation links, automation API keys, and any MSP delegation grants together in Permissions and Access.
If an MSP administers your workspace, inspect the grant’s scope, duration, and impersonation consent in If a Partner Manages Your Workspace separately from Members & Invitations.
Ask your account team to confirm regional availability and contractual coverage before sending data subject to residency requirements.
Compliance Review
| Assessment area | Documentation and artifacts available from your account team |
|---|---|
| SOC 1 | Request Glow’s current SOC 1 documentation and control scope for financial-reporting workflows. |
| SOC 2 | Request Glow’s current SOC 2 report, trust services criteria coverage, and security architecture package for vendor due diligence. |
| GDPR & Data Deletion | Request the Data Processing Agreement (DPA), subprocessor list, and retention schedule. Workspace deletion and GDPR erasure requests cover workspace records, execution history, uploaded files, and stored connection tokens. |
For a vendor review, send your account team the required report scope, data regions, retention periods, and service-level terms. Confirm these requirements in the applicable agreements before production use.
- Run
- Audit workspace roles in Members, inspect Variables for encrypted secrets, and check Team settings → Governance for MSP delegation grants
- You should see
- All active access paths, encrypted secret entries, and delegation scopes are visible before production deployment.
What’s Next?
- Review workspace governance and deletion safeguards in Workspace Settings.
- See how sensitive values are stored and used in Secrets and Variables.