Trust Center
Version 1.0
Last Updated: July 19, 2026
Welcome
Trust is fundamental to how SetRoasFlow is designed, built and operated.
SetRoasFlow is a privacy-first Customer Data Platform (CDP) that enables Merchants to collect, process and route customer events using a secure, server-side architecture.
This Trust Center provides transparency into our security, privacy, infrastructure and compliance practices.
Our Principles
Everything we build follows a small set of engineering principles.
Privacy First
Privacy is incorporated into the platform architecture rather than added after development.
Merchant Control
Merchants decide:
- what data is collected;
- which Collection Methods are enabled;
- which Destinations receive data;
- how consent is managed.
Security by Default
Security controls are applied throughout the platform using secure defaults and least-privilege access.
Transparency
We publish documentation describing how the platform processes data, how infrastructure is secured and how privacy is implemented.
Security
SetRoasFlow follows modern cloud-native security practices.
Highlights include:
- Edge processing
- Encrypted communications
- Least-privilege access
- Infrastructure isolation
- Secure secret management
- Operational monitoring
- Incident response procedures
- Privacy-aware logging
For additional information, see:
- Security Overview
- Privacy Architecture
Privacy
Privacy is an engineering requirement throughout the platform.
Key principles include:
- Privacy by Design
- Data Minimization
- Hash-first Processing
- Consent-aware Routing
- Geo-aware Enforcement
- Merchant-controlled Destinations
For additional information, see:
- Privacy Policy
- Data Processing Addendum
- Privacy Architecture
Infrastructure
SetRoasFlow is built using modern managed cloud infrastructure.
Current infrastructure includes:
| Component | Provider |
|---|---|
| Edge Runtime | Cloudflare Workers |
| Distributed State | Cloudflare Durable Objects |
| SQL Database | Cloudflare D1 |
| Application Database | Supabase |
| Dashboard | Next.js |
Infrastructure providers may evolve over time as the platform grows.
Data Processing
Merchant Customer Data flows through a structured processing pipeline.
Typical stages include:
- Collection
- Validation
- Consent Evaluation
- Identity Resolution
- Customer Profile Update
- Audience Evaluation
- Destination Routing
Additional information is available in the Data Flow & Processing Description.
Compliance
SetRoasFlow has been designed to support Merchants in meeting applicable privacy obligations.
Platform capabilities include support for:
- consent-aware processing;
- configurable data routing;
- secure server-side event collection;
- Customer Profile management;
- configurable integrations;
- deletion workflows.
Merchants remain responsible for complying with laws applicable to their own business.
Subprocessors
SetRoasFlow maintains a published list of infrastructure subprocessors.
Current infrastructure providers include:
- Cloudflare
- Supabase
Merchant-selected advertising and marketing platforms are not considered SetRoasFlow subprocessors because they are selected directly by the Merchant.
Availability
SetRoasFlow continuously monitors platform health and operational reliability.
Operational monitoring supports:
- service availability;
- infrastructure health;
- incident detection;
- operational diagnostics.
Future availability metrics may be published within this Trust Center.
Responsible Disclosure
We appreciate reports from security researchers acting in good faith.
If you believe you have identified a potential security vulnerability, please contact:
Please include sufficient technical detail to allow reproduction of the issue.
Do not publicly disclose vulnerabilities until they have been investigated and resolved.
Documentation
The following documents are available.
Legal
- Privacy Policy
- Terms of Service
- Data Processing Addendum
- Cookie Policy
- Acceptable Use Policy
Security
- Security Overview
- Privacy Architecture
- Data Flow & Processing Description
- Data Retention Policy
- Subprocessors List
Roadmap
As SetRoasFlow evolves, this Trust Center will expand to include:
- Security Whitepaper
- Incident Response Policy
- Business Continuity Policy
- Responsible Disclosure Policy
- Vulnerability Disclosure Program
- Infrastructure Status
- Availability Metrics
- Audit Reports (where applicable)
Contact
Privacy
Security
Legal
General
Version History
| Version | Date | Description |
|---|---|---|
| 1.0.0 | July 19, 2026 | Initial publication. |
End of Trust Center