Security

How FlowState is secured

In plain words: where your data lives, what the relay and this website can and can't see, and the limits we know about. It describes what the code does today.

Your data stays on your computer

FlowState keeps your project memory in one SQLite file on your computer.

No accountLocal FlowState needs no account and makes no network calls. Features that send data somewhere, like an off-site backup to your own private GitHub repo or the relay, are off until you turn them on.
Apps on this computerDesktop apps talk to FlowState directly, not over the network.
The HTTP serverIf you turn it on, it listens only on this computer (127.0.0.1) unless you pick another address, and it won't start without a bearer token of 16 or more characters. The token is kept in Windows Credential Manager, the macOS Keychain, or on Linux an owner-only file.
No secrets savedA write that looks like a key, token, password or card number is refused and not saved. The check is pattern-based, so it can miss some.

How the relay passes your traffic

The relay lets AI apps in the cloud reach FlowState on your computer at https://<handle>.fsmcp.com/mcp. It passes the encrypted connection through without opening it.

Your key stays homeWhen you enroll, your computer makes the TLS key for your address. It never leaves your computer. The relay never receives the key, a certificate request or the certificate.
Your own certificateYour computer gets its own certificate from Let's Encrypt. The relay only publishes a DNS check value for your address while it does.
PassthroughFor each new connection, the relay reads only the name of the address it is for. Then it copies the encrypted bytes both ways, unchanged. Your computer ends every encrypted connection itself (TLS passthrough).
Outbound onlyYour computer connects out to the relay over TLS and checks the relay's certificate. You don't open a port on your router.
Sign-in on your computerEach AI app signs in to your own FlowState, inside the encrypted connection. You approve it on a FlowState page with your owner passphrase and choose Read only or Read and write. Five wrong passphrases within 15 minutes lock approvals for up to 15 minutes.
Cut an app offflowstate remote clients lists your apps. flowstate remote revoke --client ID stops one at once.
Fake certificate checkOnce a day, your computer looks in public Certificate Transparency logs for any certificate for your address that wasn't made with your key. If it finds one, it warns you in flowstate relay status and at the top of every FlowState brief.

What the relay sees and keeps

The relay can't read what passes through. It does see some facts about each connection.

What it seesYour address, the IP address and port of each app that connects, when, for how long, and how many bytes pass.
Connection logFor each connection: the device, the app's IP address, the time, how long it lasted, and bytes in and out. You see it on your account page. It is kept 30 days, then deleted. The relay's own log files hold the same kind of facts, never content, tokens, URLs or headers, and are deleted after 30 days.
Your deviceIts address, its status and dates, the account it belongs to, and a hash of its device token, not the token itself. Enroll codes are kept only as hashes too.
Not your dataThe relay has no copy of your FlowState data.

What this website keeps

flowstatemcp.com runs your account. It uses Supabase for sign-in.

No passwordsSign in with Google, GitHub, or a 6-digit code sent by email.
SupabaseKeeps your sign-in record: your email address and the sign-in methods you linked. If you use Google or GitHub, it also keeps the profile details they send at sign-in. This site reads only which methods you use.
Account rowOne row per account: a random id, when it was made, and your plan. No email or name.
Devices and logYour device and connection log come from the relay each time you open your account page. The website doesn't keep a copy.
AnalyticsCloudflare Web Analytics counts page views. It sets no cookies.
Not your projectsNothing from your FlowState projects is shown or kept on the website.

How your account is protected

What the website does to keep your account yours.

Session cookieEncrypted and sealed (AES-GCM), so it can't be read or changed without the website's secret key. It is HttpOnly (page scripts can't read it), Secure (HTTPS only) and SameSite=Lax, and lasts up to 30 days. Every request checks your sign-in against Supabase's public keys.
FormsEvery action is a POST form. It must come from this site and carry a token that matches a cookie set by this site, so other sites can't act for you.
Page rulesA strict Content Security Policy: no inline scripts, scripts only from this site and Cloudflare's analytics, and no other site can show these pages in a frame. Browsers are told to use HTTPS only.
Rate limitsSign-in, email codes and enroll codes are rate limited per IP address.
Enroll codesA code works once, expires after 15 minutes, and is shown only once. You can get 5 codes an hour.
One deviceOne device per account: the computer where FlowState runs.

Removing a device or your account

What happens, and what is left.

Remove a deviceOn your account page, press Remove. The relay disconnects it, and its address stops working for good. Addresses are never given out again.
SuspendSuspend stops the device without removing it. Resume turns it back on.
On the computerRun flowstate relay forget there. It deletes the device token, keys and certificate. Your FlowState data is not touched.
Delete your accountRemoves your relay devices and their addresses, your connection log, your unused codes, your waitlist place and your sign-in. Left behind: your account row, marked deleted, with no email or name in it, and the relay's record of your retired address, no longer linked to you, so it is never reused. FlowState on your computer is not touched.

Open source

FlowState is open source under the MIT license, including the relay agent that runs on your computer: github.com/dialectforge/FlowState. The protocol between your computer and the relay is published there too (docs/relay-protocol.md). Anyone can read how keys, certificates and connections are handled.

Limits

What we can't promise.

BetaFlowState Relay is a beta, run by a small company, DialectForge.
No auditNo outside firm has audited FlowState, the relay or this website.
Relay serverIts code is not public. What this page says about it is our description of how it works.
DNSThe relay controls DNS for fsmcp.com. So it could, in principle, get a certificate for your address and read your traffic. The daily certificate check would warn you after it happened. It can't prevent it.
Connection factsThe relay sees which apps connect, when, from which IP address, and how much data passes.
Your computerYour FlowState database is a plain SQLite file, not encrypted by FlowState. Anyone who can get into your computer account can read it. Keep your computer locked and up to date.
Delete is not eraseDeleting a record in FlowState keeps it in the edit history and in your backups, so the text is still in the database file.

Report a security problem

Email support@flowstatemcp.com. Tell us what you found and how to see it happen. Please don't send passwords, keys or tokens, and give us time to fix it before you make it public.