1. How we think about it
Cofleet works from what your team already knows: your chat, your meetings, your code and your customer signals, all in the room. Bringing that together takes trust, and these are the rules we hold ourselves to.
- Ingest only what a connected source is scoped to give us, and stop when it is disconnected
- Keep account data and workspace content in the EU
- Isolate every workspace at the database level, not in application code
- Send product telemetry from our servers to PostHog's EU cloud, limited to identifiers, fixed categories, counts, timings and cost totals; no message or memory content, browser analytics or session replay
2. Subprocessors
These are the third parties that can process customer data on our behalf. Each is under a written contract with confidentiality and security terms, and where a transfer leaves the EU or EEA it runs on the European Commission's standard contractual clauses.
| Subprocessor | What it does for us | Data it can reach | Location |
|---|---|---|---|
| Google Cloud (Google Ireland Ltd) | Application hosting, the primary database, this website's file storage, the Gemini AI model (served through Vertex AI), and sending waitlist confirmation and beta-update email through Google Workspace | All workspace and account data; workspace content read by the model; the email address, signup type and any previously submitted questionnaire answers of anyone requesting a demo, expressing design-partner interest or joining the waitlist | Hosting in europe-west1, Belgium (EU); model calls may run on Google infrastructure globally |
| Cloudflare, Inc. | DNS, TLS termination and edge proxying for our domains | Request metadata (IP address, user agent, requested URL) | Global edge network, EU entry preferred |
| PostHog, Inc. | Server-side product telemetry: which features ran, AI call metadata (model, token counts, latency) and a daily model-cost total per workspace. | Account id, workspace id, run id, fixed category labels, counts, timings and USD totals. No message text, no memory content, no names, no email addresses. | EU cloud (eu.i.posthog.com) |
| Google LLC (Google Fonts) | Web fonts on the marketing site | Request metadata (IP address, user agent) | Global |
We will tell you before adding or replacing a subprocessor. To be told, email markus@cofleet.dev and we will add you to the notification list. A customer who reasonably objects on data protection grounds can terminate without penalty.
3. Security measures
Technical and organisational measures under GDPR Art. 32:
- TLS 1.2 or better on every connection, with HTTP Strict Transport Security enforced
- Encryption at rest for the database and for stored integration tokens
- No passwords: sign-in is through Google, so there is no password database to breach. API tokens and client secrets are stored as argon2id hashes, never reversibly
- Workspace isolation enforced by Postgres row level security, so a query that forgets its tenant returns nothing rather than someone else's rows
- Session cookies that are httpOnly and same site, so page scripts cannot read them
- Least privilege access for our own team, reviewed when someone joins or leaves
- Dependency pinning, a seven day quarantine on newly published package versions, and an install script allowlist
- Automated tests that specifically assert cross workspace isolation, run before release
4. Retention and deletion
The schedule is in the Privacy Policy. In short: content lives as long as the workspace does, then 30 days, then it is gone. Disconnecting a source deletes its access token immediately. Ask us and we will purge without waiting out the 30 days.
5. Data subject requests
Send requests to markus@cofleet.dev. We acknowledge within 3 working days and answer within one month, extendable by two more for a complex request, in which case we will tell you why.
If the request concerns data we hold as a processor, for example content ingested from your employer's Slack, we forward it to that customer within 3 working days and support them in answering it. They decide; we execute.
6. If something goes wrong
On confirming a personal data breach we notify the supervisory authority within 72 hours, and affected customers without undue delay, with what we know, what we are doing, and what you should do. Where we are the processor, we notify the customer first and let them lead.
To report a vulnerability, email markus@cofleet.dev. We will not pursue anyone who reports in good faith, tests only against their own workspace, and gives us reasonable time to fix it.
7. Data processing agreement
Customers who need a signed data processing agreement under GDPR Art. 28 can request one at markus@cofleet.dev. It incorporates the subprocessor list above and the standard contractual clauses for transfers outside the EU and EEA.