Trust
Hosted FluxyChat is open beta. Below are the pages we actually publish. There is no SOC 2 letter, no pen-test PDF, and no HIPAA BAA on this site. Those wait on paying customers and a written MSA.
Legal and ops
- Data processing addendum. You are controller; hosted is processor.
- Subprocessors: Cloudflare, Vercel, Clerk, Stripe, plus any LLM vendor you turn on.
- Privacy policy · Terms
- Status is Worker
/health. It is not a multi-region SLO. - security.txt if you found a hole.
- Incident rooms is product copy for a war-room scaffold. It is not our public postmortem feed.
- Report illegal content is a DSA hosting notice for public share URLs. We are not a very large online platform. Contact: fluxychat@outlook.com. Not legal advice.
Encryption
TLS on the wire. Optional room envelopes use a key wrapped by the Worker. Operators who can read Worker secrets can unwrap. When invokeAgent runs, the model sees plaintext for that turn. This is not customer KMS and not Proton-style zero-access.