Trust

Trust and security

What the guided installer can touch in your Cloudflare account, what leaves a deployment, and how to revoke all of it.

Effective September 10, 2026

The short version

Discoflare is MIT-licensed software that runs in your own Cloudflare account. There is no Discoflare server between you and your workspace, no vendor database holding your messages, and no subprocessor list for your workspace data—because there is no service processing it.

That leaves four explicit boundaries: the temporary bootstrap on this website, Discoflare Admin in your own account, an anonymous deployment heartbeat, and the source you deploy.

What the installer asks for

During bootstrap, discoflare.com keeps the OAuth access token in an encrypted, HTTP-only session cookie that expires after one hour and is never written to a Discoflare database.

Managed Setup stores the returned renewable OAuth credential only as encrypted discoflare-admin Worker secrets, then removes the website session. Admin uses it only for fixed installation, update, RealtimeKit, email, and repair operations in the selected account.

Private Setup retains no renewable OAuth credential. Instead, the operator submits an Account Admin Token directly on the Admin workers.dev origin. Neither credential enters a workspace Worker.

Later Admin sign-ins reuse the same OAuth client with only identity, membership, and Worker-verification read scopes. Admin keeps a stateless encrypted cookie; no Cloudflare Access application or Admin database is required.

Bootstrap Discoflare Admin

Create or repair the small account-local Admin Worker.

workers-scripts.readworkers-scripts.write

Choose the account

List the Cloudflare accounts you can deploy into so you can pick one.

account-settings.readuser-details.readmemberships.read

Operate managed installations

Let the account-local Admin provision, update, and repair the Cloudflare resources you request.

d1.readd1.writecontainers.readcontainers.writeworkers-kv-storage.readworkers-kv-storage.writeworkers-r2.readworkers-r2.writerealtime.readrealtime.writerealtime.adminzone.readzone-settings.readzone-settings.writedns.readdns.writeworkers-routes.readworkers-routes.writeemail-routing-rule.reademail-routing-rule.writeemail-sending.reademail-sending.write

The installer never asks for billing, audit log, account member management, or Zero Trust device permissions, and it cannot read Worker code or data in Cloudflare accounts you did not select.

What leaves a deployment

A guided installation records one row after it deploys, and sends an authenticated weekly heartbeat afterwards. That row is the complete set of what this project ever learns about a workspace:

Stored	What it is
`installation_id`	A random identifier generated for the deployment. It is not derived from anything about you.
`account_worker_hash`	A keyed HMAC-SHA-256 of the Cloudflare account ID and Worker name, used to recognise an update of the same deployment. It cannot be reversed without a secret held only by this site.
`token_hash`	A SHA-256 hash of the heartbeat token, so a deployment can authenticate its own later heartbeats.
`version`	The Discoflare release that was deployed.
`deployments`	How many times this deployment has been installed or updated.
`has_d1, has_r2, has_kv, has_custom_domain, has_email, has_agents, has_huddles`	Booleans recording which Cloudflare resource types and optional features are configured. Never amounts, sizes, or usage.
`first_seen_at, last_deployed_at, last_heartbeat_at`	Timestamps.

The workspace owner can turn the heartbeat off in Settings → Telemetry. The public counters on this site are aggregates of these rows and cannot identify a deployment.

What never leaves

The Cloudflare account ID, the Worker name, the workspace hostname, the domain, and the owner's name and email are not stored. Neither are messages, mail, files, database records, tasks, member lists, Agent transcripts, or any measure of how much of anything a workspace holds.

Owner name, email, and password are sent to Cloudflare as encrypted Worker secrets during a first installation and are not intentionally retained by this site afterwards.

Agent boundaries

Agents are workspace members, not sign-in identities. An Agent never receives a browser session or a human login, so a member's OAuth or social sign-in grants it no repository, shell, credential, or deployment access. It cannot enter a private Channel it has not joined, every Mail action requires an explicit mailbox grant, and risky conversational commands pause until an authorized member approves them.

Each Agent owns a durable Computer whose filesystem lives in Durable Object SQLite. Linux commands run through an isolated Cloudflare Container backend; large artifacts belong in your R2 bucket. The complete boundary is documented in the Agents guide.

Compliance posture

Self-hosting moves most compliance questions from this project to you and Cloudflare. Stated plainly:

Area	Status	Detail
SOC 2	Not applicable to your workspace	Discoflare runs no service that holds workspace data, so there is no processing environment to audit on your behalf. This website runs on Cloudflare, which is independently SOC 2 Type II and ISO 27001 certified. The project itself has not been audited.
GDPR	You are the controller	A workspace you deploy runs in your account under your control, so Discoflare is not a processor of its data and no data processing addendum is required for it. How this website handles information is covered by the privacy policy.
Data residency	Wherever your account runs	Discoflare chooses no region. Your workspace lives in the Cloudflare account you deployed it into, under the settings you configure there.
HIPAA	No BAA offered	The project signs no Business Associate Agreements. Whether a workspace you operate yourself may carry protected health information is an assessment between you and Cloudflare.
PCI DSS	Out of scope	There is nothing to buy. Discoflare has no billing, no checkout, and no cardholder data anywhere in the project.

Subprocessors

Your workspace has none by default. It runs on the Cloudflare account you own, and enabling voice huddles adds RealtimeKit, which you configure with your own credentials.

This website uses Cloudflare for hosting and for the D1 database holding the deployment rows described above, and GitHub for source, releases, and the installer manifest it downloads. Nothing on this site is shared with advertising or analytics providers, because it uses neither.

Reporting a vulnerability

Report security issues privately through a GitHub security advisory on the Discoflare repository. Please include the affected version and enough detail to reproduce the issue. Do not open a public issue for a security report.