Security at XrayFlow
A summary of local processing and the optional server-backed features that handle data differently.
1. Local and Server-Backed Processing
Core workflow analysis runs in the browser — we never analyse or score your automation logic server-side. Fetching a blueprint is proxied through our server, because most automation platforms do not permit direct browser requests. Optional account, AI, background-migration, and target-push features use separate server or provider requests.
- Core local analysis: Pasted or uploaded workflows are processed in your browser on this path.
- Connected credentials: Credentials saved for supported account features are encrypted at rest in the server-side integration vault.
- Background migration: With a user action after the consent disclosure, the workflow is encrypted in Redis and has a 24-hour TTL backstop.
2. Infrastructure
- Hosting: The application is deployed on Vercel.
- Application headers: The application configures content security and other response headers. See the source for the current policy.
- Selected encryption: Integration credentials and background-migration payloads use AES-256-GCM encryption at rest; this is not a claim about every account record.
4. Live Blueprint Analysis
See our engines analyze your actual workflow in real time.
Paste a blueprint or load a scenario to run Xray Flow's analysis tools: security & resilience findings, data flow & PII mapping, privacy checks, and module configuration extraction.
Two processing modes:
- Local blueprint analysis: If you paste or upload a blueprint, core analysis runs in your browser. This path does not upload the workflow.
- Connected Make retrieval: The server uses the connected account credential to retrieve the selected scenario. Saved credentials are encrypted at rest in the integration vault.
5. Data Privacy
- Your Intellectual Property: We do not claim ownership of your blueprints.
- AI features: Prompts or workflow context are sent to the custom endpoint configured in your account. Provider terms govern its processing and retention.
6. Security Architecture & Data Flow
XrayFlow implements a privacy-by-design architecture with two distinct processing modes. The diagrams below illustrate how data flows through each mode and the security controls at each layer.
Mode 1: Local Blueprint Analysis
Core analysis of a pasted or uploaded workflow runs in your browser
1. Blueprint Input
User pastes JSON or uploads .json file in browser
2. Client-Side Parsing
Rust WASM engine parses blueprint in browser memory
3. Analysis Runs
Security, data flow, privacy checks, and module extraction run locally
4. Report Generated
Diagram, documentation, audit findings created in browser
5. User Exports/Downloads
PDF, DOCX, Markdown downloaded directly — no server upload
Mode 2: Connected Make.com Retrieval
Connected-platform retrieval uses a separate server request.
1. API Key Entry
A connected platform credential is used for the retrieval request
2. Scenario Selection
User selects scenario from their Make.com account via UI
3. Ephemeral Server Fetch
The server uses the connected credential to request the selected workflow from Make.com
4. Client-Side Analysis
Blueprint sent to browser → WASM engines run locally (same as Mode 1)
5. Report Generated & Exported
Results created in browser, downloaded directly
5b. Exceptions — DOCX & AI (never stored)
DOCX export POSTs the generated markdown to /api/convert-docx and receives a Word file back; AI insights POST a blueprint-derived prompt through our server to your configured provider. Both are opt-in per action, held in memory only, and never written to disk or logged.
Data Protection
- HTTPS for network requests
- Core workflow analysis runs in the browser
- AES-256-GCM for saved credentials and migration payloads
- Background migration payloads have a 24-hour TTL backstop
Infrastructure
- Vercel application hosting
- Configured application security headers
- Configured response security headers
- CSP, HSTS, COOP, and CORP headers
Data Retention & Access
- Portfolio and document versions can be stored in browser local storage
- Connected credentials are encrypted at rest in the integration vault
- AI provider retention follows the configured provider's terms
- Background job status records have a one-hour TTL
7. Optional AI Provider Requests
AI generation and AI-assisted document features are separate from core local workflow analysis. When you request an AI feature, Xray Flow sends the prompt or workflow context from a server route to the custom endpoint configured in your account.
The endpoint may be a provider selected by the account owner. The prompt or workflow context sent depends on the AI feature requested; do not treat it as part of the local-only path.
The custom endpoint key is stored encrypted at rest in the account profile. The provider's own retention and training terms apply. Review those terms and the Privacy Policy before enabling or using an AI feature.
Frequently asked questions
How are connected platform credentials handled?
Credentials saved for connected platform features are encrypted at rest with AES-256-GCM in the server-side integration vault. The server decrypts them when a supported provider request needs them; browsers receive connection status, not token values. Core analysis of pasted workflow JSON does not need a platform credential.
Do you store my blueprints or scenarios?
Core local analysis does not upload the workflow. Browser local storage can hold portfolio entries, document versions, and manually imported blueprints. If you choose background migration, the job payload is encrypted in Redis, removed on terminal job updates, and has a 24-hour TTL backstop. Target push sends the converted workflow to the connected platform through our server.
Do you use my data to train AI models?
Xray Flow does not operate a model-training process using workflow content. AI features send prompts or workflow context to the custom endpoint configured in your account; the provider's retention and training practices are governed by its own terms.
How is my data encrypted?
Connected platform credentials and background-migration payloads use AES-256-GCM encryption at rest. Other account records are not covered by that statement. Data in transit uses HTTPS; no infrastructure certification is claimed here.
Is Xray Flow affiliated with Make.com?
No. Xray Flow is an independent tool and is not affiliated with Make.com.
8. Vulnerability Reporting
To report a suspected vulnerability, email [email protected]. Include enough detail to reproduce the issue, but do not send credentials or personal data.