What ThroughLine stores

ThroughLine is a workflow registry — it tracks the structure, stages, and history of process workflows. It is not a document management system or loan origination system, and it is not designed to store loan-level personally identifiable information (PII) or nonpublic personal information (NPI).

• Workflow definitions, stages, and metadata
• Change history (who changed what, and when) for workflows created in the system
• Account and team membership data for your organization

We recommend customers avoid entering borrower names, loan numbers, SSNs, or other NPI into workflow fields, and to use internal reference IDs or synthetic identifiers instead. We're happy to advise on naming conventions during onboarding.

Infrastructure

ThroughLine runs on Cloudflare's edge platform:

• Compute: Cloudflare Workers
• Database: Cloudflare D1 (SQLite-based)
• File storage: Cloudflare R2

All traffic to ThroughLine is encrypted in transit (TLS). Data at rest in D1 and R2 is encrypted using Cloudflare's platform-level encryption.

Multi-tenancy and data isolation

Today, each customer runs on their own dedicated Worker and D1 database instance — there is no shared database or tenant-ID row-scoping mechanism, because there's no shared database to scope. Your data is physically separate from every other customer's, not just logically filtered.

As ThroughLine grows toward a shared, self-serve deployment model, this section will be rewritten to describe whatever tenant-isolation mechanism that architecture actually uses (e.g. per-tenant row scoping vs. per-tenant database) — we won't leave this describing the old model after the underlying architecture changes.

Access controls

• Access to production data is limited to the ThroughLine team (currently: founder-level access only).
• All administrative access is logged.
• We do not access customer workflow data except as needed to provide support, troubleshoot an issue you've reported, or maintain the system.

Data retention

• Workflow history is retained for 999 days, after which older history entries are pruned. Active workflow records themselves are not deleted.
• Deleted accounts: data is retained for 30 days after account closure, then permanently deleted, unless a longer retention period is requested in writing.

Incident response

If we discover a security incident affecting your data, our process is: contain it immediately (revoke access, rotate credentials, patch the vulnerability), assess what was actually affected, and notify affected customers without undue delay — no later than 72 hours after we confirm an incident involving customer data, by email to your account's Governance Contact.

We're a small team today (see Access controls above), so in practice this is a direct, founder-level response rather than a dedicated security operations process — but it's a real commitment we hold ourselves to, not a placeholder for one we'll write later.

Try before you trust

If you'd like to evaluate ThroughLine before entering any real organizational data, we encourage starting with synthetic or placeholder workflow data. This lets your team validate the product without any data-security conversation being a blocker up front.