This page records changes to what flowscope records, changes to its commitments to customers, and its compliance milestones. Entries are posted newest first, each dated with when it took effect.
How customers are notified
This page is the canonical record, and two kinds of change are also sent to customers directly:
- New subprocessors are announced on the subprocessors page at least thirty days before they process customer data; that page is the notice. Customers under the Standard Contractual Clauses also receive an email to their designated contact. To subscribe to a courtesy email, write to
security@flowscope.comwith the subject line "Subscribe: subprocessor changes" and your organization name. - Security incidents affecting Customer Data are notified to the customer contact without undue delay, within the timeframe committed in the applicable agreement (72 hours by default).
Planned maintenance that could interrupt access is posted here ahead of the window.
Change log
2026-09-29 · Copilot conversations inside Teams and Outlook are recorded
During a Discovery engagement, flowscope records conversations in the Copilot pane inside Teams and Outlook, on the desktop and on the web, where those applications are on the allowlist.
2026-09-25 · GDPR and HIPAA programs compliant
Oneleet completed its review of flowscope's GDPR and HIPAA programs on September 25, 2026, and assessed both as compliant.
2026-09-24 · Restricted Data in two groups
The customer agreement names two groups of Restricted Data. Excluded Restricted Data stays out of the observation scope, and Controlled Restricted Data is accepted under the capture controls.
2026-09-24 · Thirty days' notice for updates that change what is recorded
Updates that change the categories of data captured carry thirty days' notice. An organization's administrators can hold the desktop application on its current version.
2026-08-11 · SOC 2 Type I report issued
Johanson Group LLP issued flowscope's SOC 2 Type I report on August 10, 2026. The report is available under NDA on request via security@flowscope.com.
2026-07-30 · The presence signal records whether the software was a browser
The presence signal recorded outside the captured scope carries one further fact: whether the foreground software was a web browser.
2026-07-16 · Presence signal for activity outside the captured scope
During a Discovery engagement, flowscope records a content-free presence signal: the time a participant spends actively working in software outside the captured scope.
2026-06-12 · Form-control state in browser capture
During a Discovery engagement, the browser extension records the state of form controls inside the allowlist, such as selected options and entered values.
2026-06-03 · Incident notification within 72 hours
A security incident affecting Customer Data is notified to the customer contact in writing within 72 hours of flowscope becoming aware of it.
2026-06-02 · Excel capture during Discovery
During a Discovery engagement, the desktop application records spreadsheet edits in Excel as they happen.