Security

Foliot runs your workflows with your data and your connections, so here is exactly how they're handled. For what we collect and why, see the privacy policy.

Where your data lives

• App: Vercel, with our functions in Frankfurt, Germany.
• Database: Neon PostgreSQL, on AWS in Frankfurt, Germany.
• Email: Resend, on AWS in Ireland.

Other providers only see data when you use what they do: Stripe for payments if you upgrade, Google when you connect Google Sheets, and Anthropic when an Ask AI step runs or you test it. Anthropic may process that prompt outside the EU. The full list is under subprocessors. A Data Processing Addendum is available for the data your workflows handle; email us to put it in place.

Encryption

• Every connection to Foliot uses HTTPS, and browsers are told never to use plain HTTP.
• Connection secrets (Slack webhook URLs, API credentials and Google tokens) are encrypted at rest with AES-256-GCM. They're never shown back to you in full.
• Connection secrets stay out of run history: a step's input shows only the connection's name, and a secret that a service echoes back is replaced with “[redacted]”. Values typed straight into a step (say, a token in an HTTP header field) are stored as typed, so keep secrets in a connection.

Signing in

• There are no passwords. You sign in with a link we email you; it works once and expires after 15 minutes.
• Sign-in links are rate-limited, and the sign-in page never reveals whether an email has an account.

Google access

Foliot asks Google only for drive.file access: it can work with the spreadsheets you pick in Google's file picker and can't see any other file in your Drive. Deleting the connection in Foliot deletes our tokens; to remove Foliot's access from your Google account too, use myaccount.google.com/permissions.

Your workflows

• HTTP request and Slack steps can't reach private, internal or cloud-metadata addresses, so a workflow can't be used to probe our network.
• The Code step runs JavaScript in a sandbox with no network access, limited to 5 seconds and 32 MB.
• Webhooks drop the Authorization and Cookie headers before saving a request.
• Webhooks accept 60 requests a minute per workflow, and forms 10 submissions a minute per visitor, to limit abuse.
• Emails your workflows send come from their own address, workflows@notify.usefoliot.com, apart from sign-in emails. The sender shows the name you choose (“your name via Foliot”), or “Foliot” when it's empty, and names like PayPal or Google are refused.

Keeping and deleting data

• Finished runs are deleted automatically after 30 days.
• The database can be restored to any point in the last 7 days, if something goes wrong.
• Deleting your account in Settings deletes your workflows, connections and run history right away. Copies in the database's restore history expire on their own.

Who can see your data

Foliot is run by one person, Vlad Poncea. To help with a support request, an admin can view the app as a user. Each time is logged, it ends after an hour at most, and billing and account deletion are blocked meanwhile. Without viewing as anyone, the admin pages also show each account's email, its workflows' names and recent run errors. Server errors are emailed to the admin and can include the error's details.

Monitoring

Server errors are emailed to us, and an outside check tests the site, the database and the alert emails every 30 minutes.

Certifications

Foliot doesn't have SOC 2, ISO 27001 or other security certifications.

Reporting a problem

If you find a security issue, email hello@usefoliot.com with the details. Please give us a chance to fix it before telling anyone else. We'll reply and keep you posted.