Security
Production insight with deliberate data boundaries.
Flowlines is SOC 2 and GDPR compliant. It analyzes MCP and agent activity while keeping transport, access and identity responsibilities explicit.
Data handling
Follow the boundary from source to evidence.
Select each stage to see what Flowlines uses for analysis and what stays outside the product boundary.
choose what leaves your server
MCP telemetry stays within the approved boundary.
Flowlines processes permitted MCP telemetry according to the workspace's capture and retention choices. Other trace sources have their own data boundaries.
A clear boundary
Observability identifiers are not security credentials.
Request IDs, user IDs and session IDs help group production behavior. Authentication and authorization remain the responsibility of your application and identity layer.
Security review
Bring your architecture and requirements.
We’ll map your telemetry sources, data fields, connector scopes and retention expectations before production rollout.
Review current security, privacy, and compliance documents in the Flowlines trust center ↗.
Security FAQ
Security and data questions, answered directly.
Is Flowlines SOC 2 compliant?
Yes. Flowlines is SOC 2 and GDPR compliant. Current security, privacy and compliance documents are available in the Flowlines trust center.
Does connecting Flowlines to my assistant give it access to my MCP server?
No. Connecting an assistant to Flowlines does not instrument your MCP server. Server instrumentation is a separate repository change that you review and approve before it ships.
Can I monitor an MCP server without sending tool payloads?
Yes. You can exclude tool arguments and results and still see usage by tool, AI client, status, duration and pseudonymous user. Excluding payloads limits what can be established about content quality, so choose the boundary per server.
Does Flowlines see the assistant's full conversation?
No. Flowlines analyzes the activity your MCP server observes and reports. It does not automatically capture the assistant's complete conversation with the user.
How does Flowlines identify users?
Only when your server is permitted to report a stable identity, and pseudonymous identifiers work. Analytics identity never replaces the authentication and authorization checks in your application.
Who decides which data leaves my server?
You do. Before production rollout we review telemetry sources, data fields, identifiers, redaction and retention expectations with your team.
100 MCP sessions a month, free