We don't keep a copy of your data.
FactoryThread is a data virtualization platform. Your data is read from your systems when a Flow runs, transformed in an isolated worker, delivered where you asked, and discarded. FactoryThread is not a system of record for your business data — the only things we store are your connection settings, your Flow definitions, and a record of each run.
What we store and what we don't
Stored
- Connection settings and encrypted credentials
- Flow and Dashboard definitions — the graph, its nodes, its schedules
- Execution metadata: run status, duration, node count, start and end times
- Identity and workspace metadata, and SHA-256 hashes of API keys
- Billing identifiers from Stripe — never card data
- On failures only, a bounded sample of the failing records, for debugging
Not stored
- Your business records
- Rows from successful runs — a successful run records no data at all
- Preview data beyond an in-memory sample that never leaves the run
- User passwords — identity is delegated to Auth0
- Card data — collection happens entirely in Stripe-hosted UI
A successful run records no data. The two exceptions are stated here rather than buried, because they are part of the boundary: on failure we capture a bounded sample of the failing records so the error can be diagnosed, and a worker may stage data on encrypted local disk during a single run to support join-style operations. Both are discarded with the run. For sensitive workloads, failure-sample capture can be minimized or disabled on request — debugging gets substantially harder, and that trade is yours to make.
Deployment options
Cloud
Our managed multi-tenant service on Azure. Isolation is enforced at the data-access layer, not at the route layer alone.
Single-tenant managed
A dedicated instance we operate, pinned to the region you choose, with your own identity provider federated in.
Self-hosted / air-gapped
The same application code, running inside your own network via Docker Compose. Authentication is delegated to your reverse proxy, and no traffic leaves your network at all.
Self-hosted is not a downgrade path or a special case we tolerate. It is the same application, schema and worker code as the managed service, released the same way. In an air-gapped deployment the reverse-proxy boundary is the only authentication checkpoint, the organization is fixed at process startup, and there is no outbound dependency on us at all — which is what makes it the right answer for workloads that cannot leave a qualified environment.
Isolation and access control
The hierarchy is Organization → Workspace → Folder. Every table that carries customer data carries a non-null organization identifier, and every read and write goes through a repository layer that filters by it — enforced at the data-access layer, not at the route layer alone, with Postgres row-level security underneath and application checks on top.
Grants go to users or to teams, at workspace, Flow and Dashboard level. API keys are 256 bits of entropy, stored only as a SHA-256 hash, scoped to a single workspace and organization, and carry the issuing user and a last-used timestamp for review and revocation. A programmatic caller cannot cross a workspace boundary, let alone an organization one.
View-only Dashboard sharing exposes the rendered Dashboard and nothing else — not the queries behind it, and not the Connections they run on. Someone who needs to see the number does not need access to the system that holds it.
AI and your data
The Assistant runs only at edit time. It works from your schema — the names and types of your Entities and their fields — and never from your records. It builds the Flow that answers your question; it does not answer from your data. It takes no part in running a Flow, and it is gone by the time one runs.
What leaves your network is a question of data residency, so here is the whole of it:
The Classify node is the one place a model sees your data. It is opt-in per Flow: where a Flow uses it, the text of the records being classified is sent to OpenAI to be embedded, and nothing else is. No other node calls a model, and the Assistant never sees a record at all.
Classify is not a generative call. It embeds your category descriptions and each record, then assigns each record to the nearest category by similarity. Nothing is generated, and nothing is written back by a model.
Regulated industries
For pharma, medical device, biotech and food, 21 CFR Part 11 and the wider GxP family apply conditionally — they bite when FactoryThread is used to create, modify or sign electronic records a regulator expects to inspect. Where they do, the recommended posture is a self-hosted deployment, so the entire system operates inside your qualified environment, under your existing SOPs and validation lifecycle, and data and audit context never leave your network.
The boundary, stated plainly: self-hosted deployment alone does not make FactoryThread Part 11 compliant or GxP validated. Validation is owned by you and depends on your intended use, SOPs, change control, training records and qualification lifecycle. We provide the application layer and the per-clause mapping; you own the envelope around it.
Compliance posture
FactoryThread does not hold SOC 2, ISO 27001, 21 CFR Part 11 or GxP certification. We have meaningful readiness alignment with the SOC 2 Common Criteria and the ISO/IEC 27001:2022 Annex A themes, but formal evidence collection and auditor validation are not complete and we have not been audited. We would rather you read that here than discover it in diligence.
Several of the providers underneath us do hold current independent attestations, and the controls they own are genuinely theirs: Auth0 owns identity and holds SOC 2 Type II and ISO 27001; Microsoft Azure owns compute, storage and physical data-centre security; Stripe owns card data, which keeps us out of PCI scope entirely. We do not claim their certifications as ours — our work is to certify the FactoryThread layer that sits on top.
We publish the gaps we are closing rather than wait to be asked: application-layer encryption for connection metadata, strict TLS verification on outbound REST calls, a unified per-organization activity log, and full Flow change history.
CAIQ-Lite, SIG-Lite, a DPA, the current subprocessor list, or a walkthrough with the team are available on request.
Or email sales@factorythread.com.