Azimuth Data Flow

Version 1.0 — 21 August 2026

Scope: every path customer data takes through Azimuth, and every boundary it crosses. Companion to Azimuth Cloud Security Posture (platform controls), Azimuth Data Governance (lifecycle and classification) and the Azimuth Subprocessor Register (who each third party is).

A data-flow diagram is the artifact security reviewers ask for first and receive least often, usually because vendors would rather describe their architecture than draw where the data actually goes. This one is drawn at the resolution the question deserves: trust boundaries and the controls on them.

1. The diagram

<text x="100" y="330" text-anchor="middle" fill="#A79C8E" font-family="sans-serif" font-size="10.5">never holds a</text> <text x="100" y="344" text-anchor="middle" fill="#A79C8E" font-family="sans-serif" font-size="10.5">provider credential</text> </svg>

2. Every boundary, and what guards it

Boundary	What crosses it	Control on the crossing
Your people → your browser	Whatever your team types or uploads	Sign-in required for every non-public route; optional two-factor; roles re-read from the database on every request
Browser → Cloudflare	Requests and content, over TLS	TLS 1.2 or better; plain HTTP is upgraded; connections below TLS 1.2 are refused
Cloudflare → our application	The same traffic, filtered	The origin firewall accepts connections only from Cloudflare's published address ranges, so the edge cannot be reached around. There is no alternate public entry point
Application → database	Your records	TLS enforced to the database; the database is not reachable from the public internet; every read and write carries your organization's identifier
Application → backups	A periodic encrypted copy	Encrypted; written to storage separate from the database; self-validating on creation; expire automatically at 35 days
Application → model providers	The prompt and the context the task needs	Server-side only, direct, with no middleware in the path. Each provider is contractually barred from training on it. Your browser never holds a provider credential
Application → your connected accounts	Only content you have approved for publishing	Publishing is locked until a named person signs off

3. What each hop actually carries

To the model providers. The task's prompt and the context it needs — the relevant part of your Knowledge Base, your brand profile, the brief. Not your member list, not your audit trail, not another client workspace's material. Voice sessions are processed in memory for forwarding and discarded; we keep the transcript, not the audio.

To the database. Your records, scoped to your organization and, within it, to the client workspace they belong to.

To the audit trail. Metadata about what happened — who, what, outcome — written append-only. Never payloads, never passwords, never keys.

To backups. A copy of the database, encrypted, on a fixed schedule.

4. What never crosses a boundary

Provider credentials never reach your browser. All AI calls are made server-side.
No secrets in the frontend bundle, and none written to logs.
No path from one organization's data to another. The organization is a required parameter of the data layer rather than a filter someone remembers to apply.
No administrative console, impersonation feature, or internal viewer of customer content — those capabilities do not exist in the product, so there is no boundary for them to cross.
No aggregator, orchestration service, analytics vendor, or prompt-logging proxy between us and a model provider. We used an aggregation layer previously and removed it deliberately.

5. Where data comes to rest

Location	What is there	How long
The database	Everything you create in the product	As long as your organization is active — we do not auto-expire your content
Encrypted backups	A recent copy of the above	35 days, enforced by a storage lifecycle rule rather than by anyone remembering
Model providers	Inputs and outputs, transiently	Deleted within 30 days under their own terms; never used for training
Your export	A complete structured copy	Yours, whenever you ask — self-service, no request needed

On deletion, the live copy goes immediately and cascades, recorded in your audit trail before it completes. On termination you have 30 days to export before deletion begins.

Change log

v1.0 (21 August 2026) — first issue. Derived by redaction from the Cloud Security Posture and Data Governance documents; boundary table verified against the running system, including the origin's Cloudflare-only restriction.