Written for legal. Findable by production.
One page, no PDF-only answers. You're handling unreleased books; these are the questions we'd ask too.
Every answer below says what is true of this build today and what the commitment is when the hosted service goes live. A security page that describes a service that does not exist is the first thing a careful reader catches, so this one does not.
Where do files live, and for how long?True today
Today: nowhere but the machine running this build. An uploaded EPUB is held in memory and in a temporary folder for the length of the check, and the working copy disappears when the process stops. When the hosted service is live: encrypted at rest in EU data centres (Frankfurt), working copies deleted 30 days after delivery or immediately on request from the title's page, deletion covering extracted images and drafts.
Who can see an unreleased book?True today
Today: only the person at this machine. There are no accounts, no sharing, and nothing is uploaded anywhere except to the description model, and only the images. When the service is live: your team and the reviewers you assign. Reflow staff access will require a support ticket you can see, will show a banner while it is open, and will write an audit-trail entry you can read.
Is our content used to train models?True today
No. Image descriptions are drafted through the Anthropic API under its standard terms, which do not train on API inputs or outputs. Your corrections tune your own house style and stay in your account; nothing crosses accounts, and nothing goes into anyone's foundation model.
Which subprocessors touch a file?True today
Named, not alluded to. Anthropic, for image description (models claude-opus-5 with claude-opus-4-8 as a fallback; images and their surrounding text are sent, the rest of the book is not). Render, Frankfurt, for hosting. Validation runs entirely on that machine: EPUBCheck 5.3.0 and Ace by DAISY 1.4.6 are local programs and send nothing anywhere. Google touches the website only, never a file: see the analytics answer below. The list lives in the DPA with notice before it changes.
What do you track on this website?True today
The website uses Google Analytics, through Google Tag Manager, and only after you say yes to the banner. Say no and nothing is loaded. What it records is how the site is used: pages viewed, which step of a check you reached, how many images a book had, and what a job cost. What it never records is anything that identifies your work: no file names, no book titles, no imprint or client names, no description text, and no image ever. This is the one place Google is involved, it touches the website and never a file, and it means some usage data is processed outside the EU. The app screens where real jobs live are excluded from search engines. You can change your answer at any time by clearing this site's cookies.
Who claims conformance?True today
You do; we prepare and document. The certify step refuses to run until every image in the book has a human decision on it, and refuses to run without a typed certifier name. The name written into the file is your imprint, never Reflow. The report separates machine actions from named human approvals and records the tool versions it was checked against.
What happens when something goes wrong?True today
The guarantee is enforced in code today: every rebuilt file is re-validated with EPUBCheck, and a file that fails is never delivered. When the service is live this is joined by a same-day incident log, honest status notes for anything customers noticed, and corrected redelivery at no charge.
Can we sign a DPA?Not yet
Not yet, honestly. There is no company to countersign one and no hosted service to cover. It is written before the first paying customer, not after, and it will be a downloadable document on this page rather than a document you have to request.