Security, retention and deletion

Tangentflow is built to collect what you need, hand it over, and delete it. The public summary is at /security and the policy at /privacy.

Private links

Each request has its own unguessable link. There is no customer account and no shared inbox, and the link stops working when the request is deleted. Once the request is submitted, the link no longer serves the files, so a forwarded link cannot be used to read them.

For tax, financial or ID documents, switch on Require an email code in the checklist. Before the link opens, the customer enters a 6-digit code emailed to the address on the request. A code lasts 10 minutes and allows 5 wrong guesses, a link can send at most 8 codes a day, and a verified browser stays in for up to 30 days. This applies to requests sent to an email address; walk-in QR codes and links you share by hand stay open. To cut a customer off, choose Reset customer link from the request menu.

Encrypted connections and storage

Pages, uploads and downloads use HTTPS. Files are stored on Cloudflare's infrastructure, encrypted at rest, and reachable only through your signed-in account, the customer's own link while the request is open, or a signed expiring link created for a webhook delivery or an AI assistant. Webhook secrets and Google Drive tokens are stored encrypted.

How long files are kept

Two settings decide the deletion date:

• The plan: Free keeps a request for up to 7 days from creation, Pro for up to 60 days. See Billing.
• The checklist: each checklist has a Delete after (max) setting from 3 to 180 days. The shorter of the two applies.

Marking a request complete starts a 24-hour countdown, after which it is deleted, never later than the plan ceiling. The checklist's Finish the request setting decides when completion happens (see How the AI agent runs a request). A customer whose link closes within 48 hours is reminded once.

Keeping a request longer

From the request menu choose Keep longer or hold:

• Move the deletion date: pick a new Delete on date, at least an hour away and no later than your plan's retention counted from the day the request was created.
• Put on hold: give a reason (shown on the request and in its timeline) and automatic deletion pauses until you click Release hold. If the deletion time passed during the hold, you get 24 hours after release.

Deletion

Deletion runs every 15 minutes for every request past its deletion date or plan ceiling and not on hold. Delete now from the request menu deletes immediately and cannot be undone.

Deletion removes every file, the file records, the customer's answers, the timeline and the conversation, and clears the customer's name, email, phone, reference, spreadsheet details and the AI summary. What remains is a record that the request existed, how many files it held, and a SHA-256 hash of a manifest listing the request ID, the deletion time and the storage keys deleted.

Opening a deleted request shows a page headed DELETION CERTIFICATE with Organization, Checklist, Created, Deleted, Files erased, Request ID and the Deletion manifest hash (SHA-256), plus a Print button. The Requests overview marks it "Deleted with certificate". The certificate holds no personal data.

AI processing

The sub-processors named in the privacy policy are:

• Cloudflare: hosting, file storage, email delivery, and reading dates and amounts from statements and receipts (Workers AI).
• DeepInfra: the document checks, submission summaries and the AI agent's replies. Its policy is not to store inputs or train on them.
• Dodo Payments: subscription billing. It never sees customer files.

Before any check result, summary or agent reply is saved, ID, account and card numbers are masked to their last four characters. The AI is told to ignore instructions inside documents and customer messages.

You control what goes to the AI. In a checklist, the AI document checks toggle switches it off entirely: files are marked "Received" and the autopilot uses plain template wording. Per item, turn off the AI check for sensitive documents such as IDs; those files are never sent, and emailed files are then not checked either, since they could be one of them. Videos are never sent, only the transcript of the audio track. Returned Word and Excel forms are not sent. See Document checks.

Emails customers can trust

Request emails are sent as "[Your business] via Tangentflow" with a note saying who asked for the documents, that Tangentflow never asks for passwords, PINs, card details or payment, and to contact your business if unsure. Replies are accepted only from the customer's address on file. See Email replies.

Bot protection and limits

The walk-in QR entry page runs a Cloudflare Turnstile check before a request is created, when Turnstile is configured. File types and sizes are checked on upload (25 MB for documents and photos, 500 MB for videos). Resending an invitation is limited to 3 a day per request. If an account is suspended, its customer links stop working at once.

FAQ

Can my customer delete a file they uploaded?

Yes, while the request is open. After it is submitted, only you can remove files, by deleting the request.

Where do I delete my whole account?

Under Settings. See Settings and branding.