Trust

Trust and security

What the guided installer can touch in your Cloudflare account, what leaves a deployment, and how to revoke all of it.

Effective September 6, 2026

The short version

Discoflare is MIT-licensed software that runs in your own Cloudflare account. There is no Discoflare server between you and your workspace, no vendor database holding your messages, and no subprocessor list for your workspace data—because there is no service processing it.

That leaves exactly three places where this project touches anything of yours: the guided installer on this website, an anonymous deployment heartbeat, and the source you deploy. All three are itemised below.

What the installer asks for

Connecting Cloudflare grants an OAuth token scoped to the permissions below. The token is kept in an encrypted, HTTP-only session cookie in your browser, is never written to a Discoflare database, and the session expires after one hour. Disconnecting revokes it immediately; you can also revoke it yourself from your Cloudflare account at any time.

The installer requests one fixed set of scopes when you connect, including the scopes for optional features. Declining workspace email or Cloudflare Access means those scopes go unused, not unrequested.

Deploy the workspace

Create and update the Worker that is your workspace, and the container image its Agent sandboxes run in.

workers-scripts.readworkers-scripts.writecontainers.readcontainers.write

Create its storage

Provision the D1 database, R2 buckets, and KV namespace the workspace stores itself in, and apply migrations.

d1.readd1.writeworkers-r2.readworkers-r2.writeworkers-kv-storage.readworkers-kv-storage.write

Choose the account

List the Cloudflare accounts you can deploy into so you can pick one.

account-settings.readmemberships.read

Attach the hostname

Point the workspace hostname at the Worker on a domain in the same account.

zone.readzone-settings.readzone-settings.writedns.readdns.write

Optional workspace email

Route inbound mail into shared mailboxes and let the workspace send replies from your domain.

email-routing-rule.reademail-routing-rule.writeemail-sending.reademail-sending.write

Optional Cloudflare Access sign-in

Create the Access application that sits in front of the workspace when you choose Access instead of built-in sign-in.

access.readaccess.writeaccess-acct.readaccess-acct.write

The installer never asks for billing, audit log, account member management, or Zero Trust device permissions, and it cannot read Worker code or data in Cloudflare accounts you did not select.

What leaves a deployment

A guided installation records one row after it deploys, and sends an authenticated weekly heartbeat afterwards. That row is the complete set of what this project ever learns about a workspace:

Stored	What it is
`installation_id`	A random identifier generated for the deployment. It is not derived from anything about you.
`account_worker_hash`	A keyed HMAC-SHA-256 of the Cloudflare account ID and Worker name, used to recognise an update of the same deployment. It cannot be reversed without a secret held only by this site.
`token_hash`	A SHA-256 hash of the heartbeat token, so a deployment can authenticate its own later heartbeats.
`version`	The Discoflare release that was deployed.
`deployments`	How many times this deployment has been installed or updated.
`has_d1, has_r2, has_kv, has_custom_domain, has_email, has_agents, has_huddles`	Booleans recording which Cloudflare resource types and optional features are configured. Never amounts, sizes, or usage.
`first_seen_at, last_deployed_at, last_heartbeat_at`	Timestamps.

The workspace owner can turn the heartbeat off in Settings → Telemetry. The public counters on this site are aggregates of these rows and cannot identify a deployment.

What never leaves

The Cloudflare account ID, the Worker name, the workspace hostname, the domain, and the owner's name and email are not stored. Neither are messages, mail, files, database records, tasks, member lists, Agent transcripts, or any measure of how much of anything a workspace holds.

Owner name, email, and password are sent to Cloudflare as encrypted Worker secrets during a first installation and are not intentionally retained by this site afterwards.

Agent boundaries

Agents are workspace members, not sign-in identities. An Agent never receives a browser session or a human login, so a member's OAuth or social sign-in grants it no repository, shell, credential, or deployment access. It cannot enter a private Channel it has not joined, every Mail action requires an explicit mailbox grant, and risky conversational commands pause until an authorized member approves them.

Each Agent runs its tools in one isolated Cloudflare Containers sandbox, checkpointed to your own R2 rather than kept alive as a permanent machine. The complete boundary is documented in the Agents guide.

Compliance posture

Self-hosting moves most compliance questions from this project to you and Cloudflare. Stated plainly:

Area	Status	Detail
SOC 2	Not applicable to your workspace	Discoflare runs no service that holds workspace data, so there is no processing environment to audit on your behalf. This website runs on Cloudflare, which is independently SOC 2 Type II and ISO 27001 certified. The project itself has not been audited.
GDPR	You are the controller	A workspace you deploy runs in your account under your control, so Discoflare is not a processor of its data and no data processing addendum is required for it. How this website handles information is covered by the privacy policy.
Data residency	Wherever your account runs	Discoflare chooses no region. Your workspace lives in the Cloudflare account you deployed it into, under the settings you configure there.
HIPAA	No BAA offered	The project signs no Business Associate Agreements. Whether a workspace you operate yourself may carry protected health information is an assessment between you and Cloudflare.
PCI DSS	Out of scope	There is nothing to buy. Discoflare has no billing, no checkout, and no cardholder data anywhere in the project.

Subprocessors

Your workspace has none by default. It runs on the Cloudflare account you own, and enabling voice huddles adds RealtimeKit, which you configure with your own credentials.

This website uses Cloudflare for hosting and for the D1 database holding the deployment rows described above, and GitHub for source, releases, and the installer manifest it downloads. Nothing on this site is shared with advertising or analytics providers, because it uses neither.

Reporting a vulnerability

Report security issues privately through a GitHub security advisory on the Discoflare repository. Please include the affected version and enough detail to reproduce the issue. Do not open a public issue for a security report.