Privacy Policy

Google API data and Limited Use

Flare's use and transfer of information received from Google APIs, including raw, aggregated, and derived Google Workspace API data, complies with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.

We do not use, transfer, or sell this data to create, train, or improve foundational, generalized, or non-personalized AI or machine-learning models. This restriction also applies to our service providers. We use Google user data only to provide the audit analysis and investigation features you request, and share it with service providers only as needed to deliver those features with your authorization.

Human access to Google user data is limited to the exceptions allowed by the Limited Use requirements, such as your explicit consent for specific support requests, security investigations, or legal obligations.

How we protect your data

We protect Google user data and other sensitive information using the following safeguards:

• Encryption in transit: Flare uses HTTPS/TLS to protect data sent between your browser, Flare, and the APIs used to provide the service.
• Encryption at rest: Our hosted Supabase database encrypts stored data at rest. Workspace OAuth credentials receive additional AES-256-GCM encryption before database storage, using a server-side encryption key stored separately from those records. The GitHub App audit connector does not store GitHub user or installation tokens.
• Access controls: Protected requests require authentication and server-side checks that restrict access to the account that owns the analysis or connector. Sensitive audit credential tables are unavailable through public database roles, and service credentials stay on the server.
• Data minimization: In AI-assisted analysis flows, Flare selects audit fields and filters recognized secrets before sending inputs to our AI provider. The GitHub App audit connector uses deterministic rules without sending audit events to that provider. Complete uploaded log files are not retained after analysis; saved findings in the AI-assisted flows include only selected supporting event excerpts. Filtering does not remove all personal information, such as actor identities or IP addresses needed for an investigation.

What we collect

Flare collects your email address and name when you create an account. For GCP, we store OAuth tokens in restricted server-side connector configuration so Flare can fetch audit logs. For AWS, we store the role ARN, ExternalId, Region, and account metadata needed to request short-lived credentials. We never ask for or store AWS access keys. For Workspace, we encrypt OAuth access and refresh tokens in server-side storage and retain the verified customer identity. The GitHub App audit connector stores the installation ID, organization ID and name, connection owner, and status; GitHub user and installation tokens remain transient. For saved GitHub reviews, Flare stores the findings, coverage counts and cited GitHub source IDs, plus stable numeric GitHub IDs for actors, apps and tokens, which are used only to label activity not seen in the last 90 days. Raw GitHub audit events are never stored. Workspace collection includes login, admin and OAuth-token report metadata; GitHub App reports read organization web audit metadata on demand. These connectors do not read Gmail, Drive file contents or repository contents. The optional GitHub window inspector does not save its findings. Other analysis flows retain results, findings, and selected source-event excerpts as described below.

How we use it

Your data is used solely to provide the Flare audit analysis service. We do not sell or use your data for advertising. GCP OAuth tokens and short-lived AWS role credentials are used only to fetch the audit activity you ask Flare to analyze. Our cloud and Workspace analysis flows send selected audit fields to our AI processing provider and retain results and selected evidence. The GitHub App audit connector uses deterministic rules without sending its audit events to that AI provider.

Data retention

Analysis results, anomaly findings, and their selected source-event excerpts are retained until you delete the analysis or close your account. GCP tokens and AWS role configuration are deleted when you disconnect the corresponding cloud connector. Workspace credentials are deleted on disconnect; saved analyses remain until deleted. Saved GitHub reviews are retained for 90 days after creation. GitHub identity history is retained for 90 days after the last observed activity. Scheduled cleanup removes expired records. These records are also deleted when you disconnect the organization, when Flare receives the GitHub App uninstall notification, or when you close your account. Disconnecting the GitHub App audit connector removes its installation and organization mapping and its saved GitHub reviews from Flare; organization owners must separately uninstall the App in GitHub to revoke its provider-side access. The optional 24-hour GitHub window inspector is not saved. Expired temporary authorization records are rejected immediately and cleaned up in bounded batches. You can request full account deletion at any time through Support.

Third parties

We use Supabase for data storage, Clerk for authentication, Vercel for application hosting, and Anthropic for AI analysis. Selected audit information and investigation context are sent to Anthropic's commercial API to generate findings and follow-up answers. Anthropic states that it does not train on commercial API inputs or outputs by default. We do not authorize training on Google user data, including by opting into training or submitting that data as model feedback. Our service providers may process data only for the purposes described here, subject to the Google Limited Use restrictions above.

Support

Questions about your data or cloud connection? Visit Flare Support or email ariel@tryflare.ai.