Regulated teams ask two questions: where the data goes, and who can compel access to it. Careful cloud processing can be enough when payloads are masked and minimized. When policy forbids raw material from leaving your control, the work has to stay on your machine or in a tenant you control. Flow can be scoped to either path. Flow-Edge, the fully local deployment, is offered per engagement and is on the roadmap, not a runtime that is live for every customer today.
Residency is not sovereignty
Residency is where the bytes sit. Sovereignty is who can demand them. A region pin answers the first question. It does not, by itself, answer a compel, a subpoena, or a vendor that can read the payload. Name which question the policy is actually asking before you pick an architecture.
When cloud can be enough
A masked or minimized payload, a contract that limits use, and a human gate before any write can be enough for some teams. That is an evaluation. It is not a blanket yes, and it is not cover for pasting privileged material into any SaaS chat.
When your own infrastructure matters
Government, health, legal privilege, and finance policies often forbid raw egress. In those cases processing stays on the customer machine or in a controlled tenant. The policy decides. A slogan about "private AI" does not.
How Flow talks about this
Flow's architecture is local-first and scoped to the engagement, so sensitive work can stay on your side when that is the requirement. Masked cloud is the option where a minimized payload in a controlled tenant fits the policy. Flow-Edge is the deployment offer when policy requires processing on infrastructure you control. It is on the roadmap and is not universally shipped today. This page carries no compliance badge that stands in for counsel.
SSO and an immutable audit log sit in the same bucket: on the roadmap or offered per engagement. Bring them up as questions for a deployment conversation. Do not tick them as live.
What a design partner should bring
The policy that forbids egress, the systems a write would touch, and who must approve it. Pair that with how approval works before a write. Glance is a separate personal product and is not this deployment.
Roadmap, not live. SSO, an immutable audit log, Action Graph, Malpractice Shield, and Flow-Edge are on the roadmap or offered per engagement. They are not a live runtime today. This page is product framing, not legal advice.
Common questions
Is cloud AI enough for HIPAA, GDPR, or government work?
Sometimes, with controls: masking, minimization, contracts, and a human gate before a write. Often the policy requires a tighter path. Evaluate the policy. This page does not claim a blanket yes, and it is not legal advice.
What is Flow-Edge status?
Flow-Edge is on the roadmap or offered per engagement. It is not a live shipped claim for every customer today. When policy requires processing to stay on your side, ask about that deployment option.
Does Flow send all documents to a public LLM by default?
No. The design is local-first, with human-gated writes. Masked cloud is an option where the policy allows a minimized payload. This page does not mean everything goes to a public model.
Related
- Real human-in-the-loop for enterprise agents (Flow)
- ChatGPT, Copilot, and privileged work (Flow)
- Glance, a separate personal product
Scope a design-partner deployment
The homepage waitlist asks for a work email and comes back with a deployment plan. Same capture the rest of the site already uses.
Get my deployment planIf you already know the environment, use the contact form.