1. How we think about it
Cofleet organises selected company knowledge and expert answers into shared memory for authorised people and connected AI tools. The accepted DPA sets the processing obligations; these pages explain them and the service’s data handling.
- Ingest only what a connected source is scoped to give us, and stop when it is disconnected
- Host account data and workspace content in the EU. Provider support and Cloudflare's global network can involve other countries; section 2 names each provider and location
- Isolate every workspace at the database level, not in application code
- Send product telemetry from our servers to PostHog's EU cloud, limited to identifiers, fixed categories, counts, timings and cost totals; no message or memory content, browser analytics or session replay
2. Providers and subprocessors
The DPA identifies the providers authorised for customer processing and distinguishes them from providers handling only Cofleet’s own business or website purposes. The support arrangements include Slack and Google Workspace when receiving customer information; their processing and international-transfer arrangements are described in DPA Annex III. No addition is authorised merely by publishing a row. See the DPA for the notice, objection and transfer safeguards.
| Provider | What it does for us | Data it can reach | Location |
|---|---|---|---|
| Google Cloud EMEA Limited | EU application and self-hosted memory hosting, database/file storage, secrets, operational monitoring and Vertex AI generation/embeddings; marketing website bucket and separate registration store | Selected customer content and derived data, prompts/outputs, account/access records, protected credentials and operational metadata | EU hosting, regional resources in Belgium and EU generation endpoint. Provider operations/support may involve other countries under the Google Cloud agreement and DPA; see DPA Annex III. |
| Google Cloud EMEA Limited (Google Workspace) | Business and support email; website signup confirmations | Business contacts, registration address, support messages and any customer information submitted with them. Customer-content email requires the applicable processor arrangement. | International processing, including outside the EU/EEA, under the Workspace agreement and Cloud Data Processing Addendum. No EU-only Workspace storage or access promise; the application’s Google Cloud region does not determine email locations. |
| Cloudflare, Inc. | DNS, network security and edge proxying for website and application/API traffic | IP addresses, request metadata, headers, authentication information and request/response bodies in transit | Global network and support; not restricted to the EU. Applicable Cloudflare DPA and transfer safeguards. |
| PostHog, Inc. | Limited server-side product analytics, feature checks, AI usage/cost monitoring, reliability, Cofleet service improvement and customer usage/cost information where offered, under the purpose-specific roles and restrictions in the DPA. | User/workspace and run/trace identifiers, timestamps, fixed categories and counts, model identifiers, timings, token counts, attempt/status/error categories and workspace cost totals. No customer content, names, emails, URLs, window titles, raw error payloads or session recordings. | EU Cloud in Frankfurt (eu.i.posthog.com). Permitted provider access may occur outside the EU under the applicable PostHog DPA. |
| Google LLC (Google Fonts) | Web fonts on the marketing site | IP address and user agent in font requests | Global; Google’s privacy information applies to this font delivery. |
| Slack Technologies Limited | Shared customer support in Cofleet AB’s paid company workspace, expected to use Slack Connect | Business contacts, messages, screenshots and support files, including customer personal data. Cofleet-controlled copies follow the DPA closure deadline. | International processing, including outside the EU/EEA and in the United States, under the completed provider DPA and applicable transfer safeguards. No EU-only storage or access promise. Customer-authored Connect content may be governed by its organisation’s settings. |
The DPA requires at least 30 days’ written notice before an added or replacement subprocessor processes customer data, with an opportunity to object. For notification-list requests, email markus@cofleet.app and we will add you to the notification list. The DPA’s objection-resolution and affected-service termination/refund procedure applies; subscribing to this list is not a condition of a customer’s contractual notice rights.
3. Security measures
Technical and organisational measures under GDPR Art. 32:
- TLS 1.2 or better on every connection, with HTTP Strict Transport Security enforced
- Encryption at rest for the database and for stored integration tokens
- Sign-in uses configured Google or Microsoft work/school identities; Cofleet does not receive the identity-provider password. Server-side session and API-token verification uses hashes
- Workspace isolation enforced by Postgres row level security, so a query that forgets its tenant returns nothing rather than someone else's rows
- Short-lived authentication cookies use httpOnly and same-site protections. Web app bearer sessions are held in local storage; the storage register describes the distinction
- Least privilege access for our own team, reviewed when someone joins or leaves
- Dependency pinning, a seven day quarantine on newly published package versions, and an install script allowlist
- Automated tests that specifically assert cross workspace isolation, run before release
4. Retention and deletion
The Privacy Policy explains the schedule and the DPA sets customer-processing obligations: active records and requested return within 30 days of closure, operational logs for 30 days, and restricted Cofleet backups removed within 90 days. Provider residual copies have separate limits. Disconnecting a connector stops future access and removes its credential; deleting previously imported content is a separate action. Removing one brain’s copy does not remove other copies. Contact us for earlier deletion or return.
Workspace closure is requested by email to markus@cofleet.app; no self-service workspace-deletion control is promised. Customer support messages, screenshots, files and Cofleet-controlled copies follow the same 30-day active-data deadline after closure. This is not a rolling deletion limit while the customer remains active. Slack Connect may require coordination with the other organisation for its own messages; archiving a channel is not deletion.
5. Data subject requests
Send requests to markus@cofleet.app. We respond without undue delay and normally within one month. Where legally permitted because of complexity or number of requests, an extension of up to two further months is available; we explain it within the initial month. No extra three-working-day acknowledgement promise applies.
For personal data processed for a customer, we promptly forward requests and assist that customer so it can meet its duties. The customer decides the request; Cofleet carries out lawful instructions.
6. If something goes wrong
Where Cofleet is controller, we notify the supervisory authority within 72 hours of becoming aware of a personal data breach unless it is unlikely to risk people’s rights and freedoms; we notify affected people without undue delay where the risk is high. Where we are processor, we notify the customer without undue delay and assist it under the DPA.
To report a vulnerability, email markus@cofleet.app. We will not pursue anyone who reports in good faith, tests only against their own workspace, and gives us reasonable time to fix it.
7. Data processing agreement
Read the Data Processing Agreement, including its processing, security, provider and transfer annexes. The Terms of Service explain organisation-authorised acceptance. Viewing either page is not acceptance. A separately agreed DPA governing the same processing takes priority.