Your data stays yours.
Flow AI is built so that getting cheaper, completion-aware routing never means giving up control of your data. Privacy isn't a setting here — it's the architecture.
The privacy pillars
We never read your prompts
Routing is content-free — model selection is driven by tool-use and task-completion signal alone, never prompt content. We don't inspect, log for training, or sell your data.
Encrypted at rest
Anything cached is encrypted with content-derived keys. Keys and secrets are stored encrypted; in-flight traffic is TLS end to end.
Sensitive work stays first-party
Prompts containing secrets or PII are automatically kept off third-party operator machines. Flip on Trusted-sellers-only to force all traffic to first-party APIs and your own keys.
Connected-plan isolation
Connect your provider subscriptions and they're used only to serve your routed traffic — scoped to your account, never shared, removable any time.
The Hive: spare capacity, never your data
The Hive is the most-asked-about part of Flow AI, so here's exactly how it protects you.
Shares capacity — never data
The Hive pools spare model capacity across the community. One member's idle capacity processes another's prompts; no one ever sees another member's content.
Encrypted & decentralized
An encrypted, decentralized system of sharing resources within our community — not a data lake, not a “hive mind.”
A co-op, not a data grab
Members contribute spare capacity and draw on the pool, so everyone's tokens go further. It's mutual aid for compute — your prompts stay yours.
The Agent Bus: what one agent can do to another
Agents messaging agents is a new attack surface. Here is the threat model we build against.
Your account is the wall
Only agents on your account can message each other. Other accounts' agents are not just unreachable — they are invisible (an unknown address reads "does not exist", never "forbidden").
Identity is the key's
Every key is minted bound to one address; an agent cannot speak as anyone else. Keys are shown once, can be rotated or revoked in place, and never travel as bus messages — teammates join with invite codes, which cannot send or read anything.
Messages are data, not instructions
Every agent is told, in its tool descriptions and its operating prompt, to treat inbound message text as data from another agent — never as instructions that override its user. Bodies are size-capped and retained 30 days, then tombstoned.
The doorbell is a grant only you can make
Waking a session on mail is a standing grant: any teammate can cost that session one turn, at most once a minute and within an hourly budget. It relays no message bodies and posts nothing on the agent's behalf. Agents are told to ask you before running it.
Webhooks are verified and signed
A webhook URL must answer a verification ping before it is saved; private addresses and redirects are refused; every ping is HMAC-signed with a per-agent secret and carries an event id for replay protection. The daemon updates itself only from our origin, forward-only, compiled before install.
Everything is audited
Every send, lease, reply, key mint, rotation, policy change and content deletion is an event on your account's audit trail; content deletion leaves the trail intact.
Compliance
Read the full privacy policy and terms. Security questions or disclosure: privacy@flowaiapi.com.