Trust Controls for AI Agents in Regulated Industries

Teams in defense, healthcare, financial services and government ask an AI agent vendor where the data lives, how the agent is stopped, and what record is kept. This page answers those questions for FlowDot as it runs today.

Summary

Emergency stop. One press from web, desktop, mobile, VR, the CLI or MCP sets a stop on your own account. It stays on until you clear it.
Tool permission prompts. FlowDot's agents ask before they run a tool. Your answers are kept on the device or app where you gave them.
Activity and cost record. The Trust Center at /observability shows your own account's recorded calls, with provider, model, tokens and cost where FlowDot paid for the call. Retention periods are listed on this page.
Hosting. FlowDot is a hosted service on AWS in the United States (us-east-1).
Calls FlowDot does not record. The Trust Center states on a banner which calls never reach the FlowDot server.

Hosting and Data Location

Item	Where it is
FlowDot application and database	AWS, United States, region us-east-1.
Model calls paid for with FlowDot credits	Sent from FlowDot's server to the model provider that serves the model you chose. Amazon Bedrock is one of those providers, in us-east-1.
Model calls with your own provider key	Sent to that provider with your key. FlowDot stores the key encrypted in its database and decrypts it to make the call.
Calls through your own ChatGPT subscription from the CLI or desktop app	Sent from your device to the provider. They do not pass through the FlowDot server.
CLI and desktop app logs	On your device, under `.flowdot/logs/`.

Any text you send to a model is seen by the provider of that model.

Emergency Stop

The emergency stop is a flag on your account, held on the FlowDot server.

What a press does

Sets the stop on your account. It has no timer and does not clear by itself.
Tells the workflow engine to stop your running workflows and your open agent streams.
Stops your active COMMS relay sessions and cancels your pending daemon commands.
Cancels your workflow runs that are still waiting in the queue.
Queues a stop command for each of your online CLI or desktop daemons.
Writes a record of the press with the surface, IP address and user agent.
Sends you an email and an in-app notification, and a message on each COMMS channel you have enabled.

What is refused while the stop is on

Server routes that carry the stop check answer HTTP 423. These include toolkit tool calls, outbound COMMS messages and relay, queued workflow runs, tool and workflow calls made by apps, and the voice agent's tools that change something or reach outside. Reading your data stays available.

Whose account it affects

A press or a clear acts on the signed-in account only. The request takes no target user. The FlowDot admin panel has no press or clear for another user's account.

Clearing

You clear the stop yourself, from /settings/panic or the equivalent control on another surface. A clear writes its own record and sends the same notifications as a press.

Can an agent press it?

A press sent with the recipe or goal mode header is refused. An MCP client can press it through the panic_stop tool when its token has the executions:manage scope and the call includes confirm: true. Every press notifies you, whichever way it was made.

Tool Permission Prompts

FlowDot's agents show a prompt before running a tool. On the web agent the choices are allow, allow for this session, always allow, and deny. The desktop voice prompt offers once, this session, always for this tool, and always for this toolkit.

Your answers are kept where you gave them. The desktop voice prompt keeps them in the app's local storage. The CLI and the desktop app keep a signed policy file on your machine.

For approval at a set point in a recipe, recipe authors use the gate step type. See Recipes.

Activity and Cost Record

The Trust Center at /observability shows the signed-in account's own records. It reads from these sources on the FlowDot server:

Source	What each row holds
Credit transactions	One row per model call paid for with FlowDot credits: model, provider, token counts, cost in US dollars, and the surface, recipe step or workflow it came from.
Aggregator API key usage	One row per request made with one of your `fd_agg_` keys, including voice session calls: model, provider, tokens, cost, latency, success or failure.
Workflow run log	One entry per workflow node that reported to the run view: node, provider, model, token counts. Nodes hidden from the run view are not in it.
Voice sessions	Start, end, duration, and the speech and model providers used.

The page has filters, a breakdown by surface, model and provider, a drill-down per row, and a CSV export.

What is not in it

Calls made with your own provider key have no cost row on the FlowDot server. Your provider bills you for them.
Calls through your own ChatGPT subscription from the CLI or desktop app never reach the FlowDot server. The Trust Center says so on a banner at the top of the page.
CLI and desktop logs stay on your device.

How long records are kept

Record	Kept for
Workflow runs, with their per-node log	90 days, then deleted by a scheduled job. You can also delete a run yourself.
Security audit log (includes each emergency stop press and clear)	365 days, then deleted by the same job.
Emergency stop events	The application has no delete for these rows. They are removed when the account is deleted.
Agent conversations	Until you delete them.

The CLI and the desktop app also keep a signed, hash-chained audit file on your own machine for local tool permission decisions.

Whose records you see

The Trust Center page shows only your own account.

Sign-in and Access

Sign-in is by email and password, with optional two-factor codes.
Provider keys you add are stored encrypted. FlowDot's own provider credentials are stored separately from user keys.
You choose which surfaces and modes may write to your memory on the /memories page. The setting is checked on the server before any memory is written.

CLI Runtime Controls

The FlowDot CLI repository contains a file named ZERO_TRUST_AUDIT.md, dated 2026-03-11. It lists what that audit reviewed in the CLI and the changes made in response. The document records these as implemented:

Web pages and search results are wrapped with an instruction that they are data and not commands before a model sees them.
Tool descriptions from MCP servers and toolkits are cleaned and labelled before they enter a prompt.
Including a file with @file goes through path validation and the file-read approval.
A FlowDot server address that uses plain http:// is rejected unless it is a loopback address.
Direct file overwrites by the agent ask for write approval.

When a server public key is set in FLOWDOT_HUB_PUBLIC_KEY, the CLI checks a signature on inbound command frames.

Review Questions

Question	Answer today
Where does the data live?	On AWS in the United States, region us-east-1. See Hosting and Data Location.
Is there a record of what the agent did?	Yes, for calls that pass through the FlowDot server. See Activity and Cost Record for the sources and the retention periods.
Can the operator stop it?	Yes, for their own account. See Emergency Stop for what a press does.
What if a model call does not pass through FlowDot?	It is not recorded on the server. The Trust Center banner names those calls.