Security & data protection

What happens to your diagrams, your code and your account, in plain words.

Hosting and encryption

The app runs on Amazon Web Services (AWS); the website is served through Cloudflare.
All traffic uses HTTPS (TLS). Diagrams, accounts and files are stored in AWS (DynamoDB and S3), which encrypt data at rest.
Databases have point-in-time recovery switched on, so data can be restored after an accident.

Sign in with Google, or with an email and password. Passwords are stored only as bcrypt hashes, never in plain text.
New email accounts are confirmed with a one-time code sent to the address.
Your boards are private to your account. A board is only visible to others if you turn on a share link, and you can turn it off again at any time.

AI features send the text you type (and, when you attach one, the file or picture) to our AI provider, Anthropic, to make or change the diagram.
Anthropic processes it under its commercial terms and does not use it to train its models. We do not use your diagrams or prompts to train any model either.
Nothing is sent to an AI service unless you use an AI feature. Editing, presenting and exporting stay within AI Flowchart.

Payments are handled by Paddle, our reseller and merchant of record. Card details go straight to Paddle; we never see or store them.

GitHub App: read-only access to code and permission to comment on pull requests. The repository is downloaded to temporary storage, read to draw the diagram and deleted straight away. We keep only the diagram (names of files, routes and services, and counts). Uninstalling removes the installation record.
Slack app: only the text of your request is sent to the AI. We keep the diagram you made and the workspace token Slack gives us to post replies. No Slack data is used to train AI.
Google Docs & Slides add-on: only the description you type is sent to the AI. No Google Workspace data is sent to any AI service or used to train models.
ChatGPT, Claude and other assistants (MCP): they connect with your permission through OAuth sign-in, and can only create and edit diagrams in your account.
VS Code extension: maps your code on your own computer. Code is only sent when you use one of its AI features.

Export any diagram at any time: PNG, SVG, PDF, PowerPoint, Mermaid or draw.io.
To delete your account and diagrams, email [email protected] from the address you signed up with.

Found a vulnerability? Email [email protected] with "Security" in the subject and the steps to reproduce it. We reply quickly and fix confirmed issues as a priority. Please give us a chance to fix it before sharing it publicly.