If you're completing a vendor review, answering a security questionnaire, or need a signed data processing agreement, this page tells you where to get each of those.
Where to find Userflow's security documentation
Userflow's Trust Center is at trust.userflow.com. It holds our security posture, policies, and compliance documentation in one place.
Some documents are public and you can read them straight away. Others are gated behind Request Access.
Requesting a gated document
Go to trust.userflow.com and find the document you need.
Click Request Access and fill in your details.
Our Security & Compliance team reviews the request and grants access.
Reviews are handled by people, not automatically, so allow time for a response. If your review has a deadline, say so in the request.
Getting a Data Processing Agreement (DPA)
If your organisation needs a DPA, request it through your Userflow contact or start a chat from your Userflow account. The DPA is the right document for questions about how Userflow processes personal data on your behalf.
Compliance certifications
Certifications and audit reports are published in the Trust Center. Where a report is gated, use Request Access.
Answering a security questionnaire
Most questionnaire items are answered by documents already in the Trust Center, so start there. If something isn't covered, contact us through chat and include the questionnaire — we'd rather answer once, accurately, than have you infer an answer from a policy document.
Cookies, browser storage, and consent
Userflow.js doesn't set any cookies in your app or on your end users' devices.
Here's what it does store, and where:
Anonymous visitor ID (local storage). If you use
userflow.identifyAnonymous(), Userflow.js saves an anonymous visitor ID in the browser's local storage, so the same visitor keeps the same ID on later visits. The ID stays until local storage is cleared. If you only useuserflow.identify(), nothing is stored this way.userflow_visitoranduserflowjs_visitor_idcookies. These belong to app.userflow.com, the Userflow app your team signs in to. They aren't set in your app.
Which consent category to use
If your consent banner asks you to categorize Userflow, list it as functional or analytics. It isn't strictly necessary.
Waiting for consent before starting Userflow
Userflow.js has no built-in consent setting. You control consent by choosing when to start it:
Don't call
userflow.init(),userflow.identify()oruserflow.identifyAnonymous()until the user has given consent. Until then, that user won't see any Userflow content.If the user withdraws consent, call
userflow.reset().