Security and privacy
Your survey data stays on your computer, encrypted. Here is everything DataFlow sends anywhere, and why none of it is survey data.
Where the data lives
- On the computer, encrypted. Each project is one file encrypted with AES-256-GCM. Its key is kept in the system's keychain (Windows Credential Manager, the macOS Keychain, the Secret Service on Linux), not beside the file.
- Raw data is never changed. Every correction is kept on top of the raw interviews, with who made it, when and why, and can be undone. The activity log is hash-chained, so a changed entry shows.
- Personal data is locked away. Variables that identify people move to a separate, separately encrypted store. Checks, reports and downloads leave them out; they come back only if someone unlocks them for a download, and every unlock is logged.
- Raw interviews in a vault. Raw data with personal information can be kept in an encrypted vault (AES-256-XTS) that also opens in VeraCrypt, for anyone who needs it without DataFlow.
The AI runs on your computer
The assistant, the personal-data check and the matching of “other” answers are small models that run on the computer, on the graphics card or the processor, and work offline. No AI service, API key or outside account is involved, and nothing is sent to one. DataFlow counts; the AI explains.
What leaves the computer
Only these, and none of them carries survey data.
| To | What | When |
|---|---|---|
| Your own survey server (SurveyLoopr, SurveyCTO or ODK Central) | Requests for your forms and new interviews | When you sync, or on your schedule |
| DataFlow's account service, or SurveyLoopr | The licence check: your account, this computer's install ID, the app's version and operating system | At launch and every 12 hours, once you sign in |
| DataFlow's account service | Usage counts: how many times a day things like syncing or running checks were done, and how far setup got. Never survey data, names or values | Once a day; off with one switch in Settings |
| DataFlow's website and Stripe, in the payment window | The checkout page and Stripe's card form. The card goes straight to Stripe, from a window kept apart from the app, which can't reach your projects | Only when you start a trial or buy |
| GitHub | The check for a new version of DataFlow, and the download when there is one; the optional models when you ask for them | At launch and every 6 hours; on request |
| Hugging Face | The local AI model, downloaded once | Only when you choose a model |
The app's window itself can't reach the internet: it runs under a strict content security policy, and only DataFlow's own code, outside the window, makes the requests above. There are no third-party trackers or analytics in the app.
Field Reports
A Field Report is a single HTML file you choose to share. It opens in a browser without a login and makes no network requests. It carries counts and rates at the level you pick (public, management or team), never the answers themselves.
Downloads you can submit
Downloads include the correction log, always, and by default the raw data as received with a Stata do-file that replays each correction from it, so the clean data can be rebuilt and checked by anyone, including a journal or an ethics board.
Signed and updated
Windows installers are signed by ARCED International LLC. Updates are signed too, and the app installs only an update whose signature matches the key built into it. Each release lists SHA-256 checksums for its files.
Report a security problem
Email hello@letdataflow.com with what you found and how to see it.