Procurement kit
For IT, security and procurement reviewers: the documents you'll ask for, a DPIA template with DataFlow's answers filled in, and short answers to the usual security questions.
Last updated 2 November 2026
The documents
- Data processing addendum: Who controls which data, sub-processors, breach notice, deletion and transfers. A countersigned copy on request.
- Security and privacy: Where survey data lives, how it's encrypted, and everything the app sends anywhere.
- Terms: Plans, seats, the trial, billing, and what happens when a plan ends.
- End-user licence agreement: The licence for the desktop app: seats, updates, open-source parts, limits.
- Privacy policy: What the app, your account and this website collect, and your choices.
- Refunds: A full refund of any charge within 30 days of it.
The company
ARCED International LLC · 30 N Gould St, STE R, Sheridan, WY 82801, USA
- ARCED International LLC's W-9 is available on request: hello@letdataflow.com.
- Paying by invoice, purchase orders and your own supplier forms: write to the same address.
DPIA template
A data protection impact assessment asks much the same questions everywhere. Here they are with DataFlow's answers, as plain text, to copy into your own form. Add what only you know: your survey's purpose, its lawful basis and who on your team uses DataFlow.
| Question | DataFlow's answer |
|---|---|
| What is DataFlow, and what does it do? | A desktop app for Windows, macOS and Linux, made by ARCED International LLC. It checks field survey data for quality problems as interviews arrive, helps fix them with an AI that runs on the computer, and logs every correction. It runs on your organisation's own computers. |
| What personal data does it process? | Survey data: whatever your form collects, which can include names, phone numbers, GPS locations and sensitive answers, and the IDs of the enumerators who collected each interview. Account data: the names and email addresses of the people who use DataFlow, their organisation, plan, seats and billing records, the licence check (an install ID, the app's version and the operating system) and daily usage counts. |
| Whose personal data is it? | Survey respondents and the people their answers name; your enumerators, through the interviews they collected; and the members of your team who use DataFlow. |
| Does it include special category or sensitive data? | Only if your form collects it, for example health or ethnicity. It's handled like all survey data: kept on your computers, encrypted. Your lawful basis and ethics approval for collecting it are your own. |
| Why is it processed? | To check and clean the survey data your organisation collects, and to report on its quality. The purpose and lawful basis of the survey itself are yours. ARCED processes account data to run accounts, licences and billing. |
| Who is the controller, and who is the processor? | Your organisation is the controller of survey data. ARCED never receives it, so it isn't a processor of it. ARCED is the controller of account data. See the data processing addendum: letdataflow.com/dpa. |
| Where is survey data stored? | Only on the computers where your team installs DataFlow, as one encrypted file per project. It comes straight from your own survey server (SurveyLoopr, SurveyCTO or ODK Central) or from files you import. ARCED never receives it. |
| Where is account data stored? | With ARCED's sub-processors: Supabase stores accounts, Stripe takes payments and keeps billing records, Vercel hosts the account service and Resend sends account emails. The full list is in the data processing addendum. |
| Who can access survey data? | People who can sign in to the computer where DataFlow keeps it, since each project's key is in that computer's keychain. DataFlow locks after 15 minutes unused (changeable in Settings) and unlocks with Windows Hello, Touch ID or the Mac's password, where the computer has them. Variables that identify people are kept in a separate encrypted store: checks, reports and downloads leave them out, and unlocking them for a download is logged. ARCED has no access. |
| Who can access account data? | ARCED, to run accounts and billing, and each sub-processor for its own part. In your team, the owner manages billing and seats, and the owner and admins manage members. |
| How is it protected? | Each project file is encrypted with AES-256-GCM, its key kept in the system's keychain (Windows Credential Manager, the macOS Keychain, the Secret Service on Linux). Raw interviews with personal information can be kept in an encrypted vault (AES-256-XTS) that also opens in VeraCrypt. The app's window can't reach the internet. Windows installers and every update are signed. Card numbers go to Stripe, never to ARCED. |
| Is AI used, and does it send data anywhere? | Small models run on the computer, on the graphics card or the processor, and work offline. No AI service, API key or outside account is involved, and nothing is sent to one. The AI explains problems and prepares fixes; nothing changes until a person approves it. |
| Are decisions about people made automatically? | No. DataFlow flags likely problems, including statistical signs that an enumerator's interviews may be made up, compared with the rest of their team. These are flags for a person to review, not decisions. Nothing changes the data until a person approves it, and every change can be undone. |
| Is the original data kept when it's corrected? | Yes. Raw data is never changed. Every correction is kept on top of it with who made it, when and why, and can be undone. The activity log is hash-chained, so a changed entry shows. Downloads include a Stata do-file that rebuilds the clean data from the raw data. |
| How long is it kept? | Survey data: for as long as your organisation keeps the project on its computers; you delete it. Account data: while the account is open, and afterwards only what tax and accounting law requires. Usage counts: kept as patterns across all users, not to follow one person. |
| Is data transferred to other countries? | Survey data: not by DataFlow. It moves only between your survey server and your computers. Account data: to ARCED in the United States and to its sub-processors, under standard contractual clauses where the law requires them. |
| What does the app send over the internet? | Requests to your own survey server for forms and new interviews; the licence check to DataFlow's account service or SurveyLoopr; daily usage counts, which one switch in Settings turns off; update checks and downloads from GitHub; AI models from Hugging Face when you choose one; and, only when you buy, the checkout page and Stripe's card form. Never survey data. Full list: letdataflow.com/security. |
| How are people's rights handled? | Survey data is held only by your organisation, so you answer requests about it from your own copy. Account data: anyone can ask ARCED to see, correct, export or delete what it holds about them, at hello@letdataflow.com. |
| What happens when the plan ends? | DataFlow becomes read-only: every project still opens, and everything in it can be downloaded. Nothing is locked away or deleted. |
Risks and how they're reduced
| Risk | What DataFlow does | Your part |
|---|---|---|
| A laptop is lost or stolen | Project files are encrypted, their keys are in the system's keychain, and the app locks after a wait unused. | Turn on full-disk encryption and a sign-in password on study computers. |
| Personal data is shared by mistake | Variables that identify people are kept apart. Checks, reports and downloads leave them out unless someone unlocks them, and every unlock is logged. | Decide who may unlock personal data, and look at the log. |
| Survey data reaches a third party | DataFlow sends survey data nowhere. The AI runs on the computer. Field Reports carry counts and rates, never the answers. | Share reports and downloads only with people who should see them. |
| A wrong correction | Raw data is never changed. Every correction is logged with who, when and why, and can be undone. | Review fixes before approving them. |
| An enumerator is wrongly suspected of making up interviews | Flags are signs for a person to check, each with its explanation, not decisions. | Back-check before acting on a flag, and follow your own staff procedures. |
| A tampered update | The app installs only an update whose signature matches the key built into it. Each release lists SHA-256 checksums. | Download DataFlow only from letdataflow.com or its GitHub releases. |
| A breach at ARCED or a sub-processor | Only account data is held there: no survey data and no card numbers. Affected account holders are told without undue delay. | Remove team members who leave, from your account page. |
| Projects are lost | Projects are files on your computers. ARCED holds no copy. | Back up project files as you back up other study data. |
Security FAQ
Short answers. Security and privacy has the detail.
Does survey data leave our computers?
Not through DataFlow. It comes from your survey server and stays on the computer, encrypted. Nothing the app sends anywhere contains it.
Can ARCED see our data?
No. We never receive survey data. The app makes only the requests listed on Security and privacy.
Is it encrypted at rest?
Yes. Each project is a file encrypted with AES-256-GCM, its key kept in the system's keychain. The optional vault for raw interviews uses AES-256-XTS and also opens in VeraCrypt.
Does the AI use a cloud service?
No. The models run on the computer and work offline. No AI service, API key or outside account is involved.
Is there telemetry?
Only daily usage counts: a fixed list of event names and numbers, never survey data, off with one switch in Settings. The app has no third-party trackers or analytics.
How are updates delivered?
From DataFlow's releases on GitHub. The app installs only an update whose signature matches the key built into it. Windows installers are signed by ARCED International LLC.
What if a laptop is lost?
Projects are encrypted, with their keys in the system's keychain. DataFlow locks after 15 minutes unused and unlocks with Windows Hello, Touch ID or the Mac's password, where the computer has them.
Does it work offline?
Yes. Checks, fixes and the AI run on the computer. Syncing needs your survey server, and the licence needs checking once every 30 days.
How do we report a security problem?
Email hello@letdataflow.com with what you found and how to see it.
Anything else
Security questionnaires and anything not covered here: hello@letdataflow.com.