Your flows never leave your browser
Deflows parses Tableau Prep, Alteryx, SSIS, and Power Query flow files entirely in your browser. Here is exactly what stays local, what is sent for AI features, and which services we rely on.
Where your data goes
- The raw .tfl / .yxmd / .yxzp / .dtsx / .pq file (or pasted M code) — parsing runs fully client-side (JSZip + XML/JSON/M).
- Sample data files bundled inside packages — never opened, never read.
- Connection attributes — server, port, and credential fields are never extracted from the file.
- Structural metadata only: table names, connection display names, joins, formulas, step configuration, and the flow's file name.
- Encrypted in transit (TLS) and used to generate your output, which is saved to your library so you can re-open it.
- Processed via the Anthropic API — API data is not used to train models.
- Row data — flow files contain none, and bundled data files stay unopened.
- Database credentials — flow files contain no passwords, and connection attributes are never extracted.
- Payment card data — handled entirely by Lemon Squeezy.
Parsing runs entirely client-side. The original file is never uploaded at any stage — AI features receive structural metadata only.
What we log
When an AI feature runs, we record usage measurements tied to your account — operation type, model, token counts, cost. No flow content, no file names.
Subprocessors
Every third-party service Deflows relies on, and what data each one touches.
| Service | Purpose | Data involved |
|---|---|---|
| Vercel | Hosting and site analytics | Request metadata, anonymized analytics |
| PostHog | Product analytics and session replay (EU-hosted) | Page views across the site; click tracking and session replay on marketing pages only, with inputs masked. No cookies are set. In the workspace at /app there is no click tracking and no session replay — only page views and a fixed list of anonymous counters recording which step you reached, the flow format, and the target you chose, never flow contents, file names, table names, or column names |
| Supabase | Authentication and usage records | Account email, usage measurements, and your flow library — structural metadata and generated outputs |
| Anthropic | AI processing (Convert and Document) | Structural flow metadata; not used for model training |
| Resend | Contact form email delivery | Name, email, and message you submit via the contact form |
| Have I Been Pwned | Checking a new password against known breach corpora | The first five characters of the SHA-1 hash of a password being chosen, sent from your browser. The password itself never leaves your device and the service cannot tell which password was checked |
| Lemon Squeezy | Payments (merchant of record) | Billing details; card data never touches Deflows |
GDPR & KVKK requests
Deflows is built in Istanbul. We honor data-subject requests under both GDPR and KVKK — access, correction, and deletion. Reach us via the contact page and we will respond within 30 days.
Policies
Security FAQ
No. Your flow file is parsed in the browser and is never uploaded. Deflows servers never receive, store, or cache the original file.
Only the structural metadata extracted in your browser: table names, join conditions, formulas, step configuration, and the flow's file name. Never the file itself and never row data.
No. AI features run on the Anthropic API, and data sent to the API is not used to train models. Deflows does not build training datasets from customer flows either.
Account and usage records live in Supabase; the site runs on Vercel. The full list of services and what each one touches is in the subprocessors table above.
No. Flow files don't store passwords, and Deflows reads only a connection's display name and connector type — server, port, and credential attributes are never extracted or sent.
Yes — the SQL, PySpark, or documentation Deflows generates for you is saved to your library so you can re-open and download it later. Deleting a flow permanently deletes its stored outputs. The original flow file is still never uploaded.