1. About FlitStack AI
FlitStack AI (formerly "Switcher"), developed by ambrstack ("ambrstack," "we," "our," or "us"), is a secure CRM data migration platform that moves customer records seamlessly between CRM instances and platforms. FlitStack AI operates on an in-memory architecture, meaning that all data is processed in memory during migration and never written to disk or stored beyond the active migration session.
To enable accurate mapping between source and destination systems, FlitStack AI may temporarily retain structural metadata such as object types, field definitions, and schema mappings. This schema information is held only for the duration of the migration and is permanently deleted upon its completion.
FlitStack AI does not store personally identifiable information (PII), CRM records (such as companies, contacts, opportunities, or activities), or any customer data outside the scope of an active migration session. This principle is central to our architecture: we focus exclusively on the "shape" of the data flow, not the operational content moving through it.
2. Scope of This Policy
This Privacy Policy applies to all aspects of FlitStack AI's operations, including its technical infrastructure, organizational processes, and contractual obligations. It governs how data is accessed, transmitted, processed, validated, and ultimately disposed of within the lifecycle of a migration performed through FlitStack AI.
- Systems and Infrastructure — Production, staging, and development environments; APIs, connectors, and data pipelines that handle CRM data during migrations; monitoring and logging services; authentication and identity management layers.
- Migration Activities — All CRM migration workflows, including extraction, transformation, validation, reconciliation, and loading of customer data. Processing is strictly in memory; CRM records and PII are never written to persistent storage.
- Subprocessors and Vendors — All third-party infrastructure providers supporting FlitStack AI's operations, each bound by Data Processing Agreements (DPAs).
- Personnel and Contractors — All ambrstack employees, contractors, or consultants with access to FlitStack AI systems.
- Global Reach — This policy applies to customers worldwide and is maintained in alignment with GDPR, CCPA, and other region-specific requirements. Certifications and audits are currently underway.
This policy does not extend to data processing activities outside FlitStack AI's operational boundaries — including customer-managed CRM instances, third-party integrations installed by the customer, locally exported data, or independent partner services engaged by the customer.
3. Data We Process
FlitStack AI processes only the categories of data strictly required to perform CRM data migrations. By design, the platform minimizes exposure to sensitive information while ensuring migration accuracy and reliability.
CRM Record Data (Processed in Memory Only) Confidential
Customer CRM objects such as contacts, companies, deals, tickets, tasks, activities, or custom objects that are part of the migration scope. These records are accessed and handled exclusively in memory for the purpose of extraction, transformation, validation, and loading into the target system.
- No CRM records or PII are ever written to disk, persisted in databases, or retained once a migration session concludes
- Encrypted in transit using TLS 1.2 or higher
- Accessible only to systems performing authorized migration processing
Schema and Configuration Metadata Confidential
Structural elements including object structures, field definitions, pipeline setups, and rules needed for accurate mapping between source and target CRMs.
- Cached temporarily only when required to support mapping and reconciliation
- Always encrypted in transit (TLS 1.2+) and at rest (AES-256)
- Securely deleted via cryptographic erasure following migration completion
Operational & System Logs Internal
Technical records of system performance, request identifiers, error codes, and monitoring events used for debugging, performance optimization, and incident response.
- Logs do not contain CRM record content or PII
- Retention is time-bound (typically 30–90 days depending on category)
- Restricted to engineering and security personnel
Authentication Data Confidential
Credentials, tokens, and session identifiers processed through FlitStack AI's identity management provider (PropelAuth). Authentication data is encrypted in transit and at rest, tokenized, and subject to automatic expiry. FlitStack AI never stores or has access to plaintext passwords.
4. Data We Do Not Process Excluded
FlitStack AI does not persist customer CRM records or personally identifiable information.
CRM records — including contacts, companies, deals, tickets, notes, attachments, and activities — pass through FlitStack AI only in memory during an active migration. They are never written to disk, exported, or retained once the migration concludes. Under no circumstance may FlitStack AI store CRM records or PII in persistent storage.
This exclusion is not a policy choice — it is an architectural decision. FlitStack AI's systems are engineered so that CRM record data exists only transiently in memory during extraction, transformation, validation, and loading. The following are also outside the scope of this policy:
- Customer-Managed Environments — Any CRM instances, applications, or servers operated directly by the customer fall outside FlitStack AI's control and remain the customer's responsibility
- Third-Party Integrations — Tools, plugins, or applications installed or connected by customers to their CRM environments are not governed by this Policy
- Local Data Handling — Data exported or stored locally by the customer, including temporary backups or staging files created outside FlitStack AI, is beyond the reach of this Policy
- Independent Partner Services — Consulting firms or systems integrators engaged by customers independently of ambrstack are not subprocessors under this Policy
5. How We Use Your Data
Customer Data processed through FlitStack AI is used exclusively for CRM migration activities. We follow recognized principles of data protection to ensure secure and compliant handling:
- Purpose Limitation — Data is used exclusively for executing CRM migrations. Customer Data is never repurposed for analytics, marketing, profiling, or product development
- Data Minimization — FlitStack AI processes only the data required to perform the migration successfully; no unnecessary access or processing occurs
- Accuracy — Migration processes are designed to maintain data accuracy and integrity, ensuring records and schema mappings are transferred correctly
- Storage Limitation — Customer CRM records are never stored; temporary schema metadata is retained only as needed for mapping and deleted after the migration
- Integrity and Confidentiality — Customer Data is protected with technical and organizational safeguards to prevent unauthorized access, secured both in memory and in transit
We do not sell, rent, or share Customer Data with third parties for advertising or marketing purposes. ambrstack acts solely as a data processor (or service provider, as applicable), processing data only as instructed by Customers.
6. Legal Basis for Processing
Under the General Data Protection Regulation (GDPR), FlitStack AI processes data on the following legal bases:
- Contractual Necessity (Art. 6(1)(b)) — Processing is grounded in contractual necessity between ambrstack and its Customers and is required to fulfill the migration services agreed under the Master Service Agreement
- Legitimate Interest (Art. 6(1)(f)) — Limited processing for security monitoring, incident detection, vulnerability scanning, and service improvement, where balanced against the rights and freedoms of data subjects
- Consent (Art. 6(1)(a)) — Where applicable, for analytics cookies, functional preferences, and marketing communications on our website
While FlitStack AI does not persist personal data, it enables customers to fulfill data subject rights requests (e.g., deletion, portability) by ensuring no residual data remains once migrations conclude.
7. Data Storage & Residency
FlitStack AI's architecture is intentionally designed to minimize the storage and retention of customer data. All migrations execute primarily in memory, with limited caching of structural metadata only where essential for mapping and reconciliation.
- No Persistent CRM Record Storage — CRM records are never written to databases or file systems. They exist only transiently in memory during extraction, transformation, validation, and loading
- Temporary Metadata Caching — Schema and configuration data may be cached to enable accurate mapping and reconciliation. This caching is time-bound and erased after migration
- Data Residency — Processing occurs within approved cloud regions that meet GDPR and SOC 2 standards (primarily AWS US-East and Google Cloud). Certifications and audits are currently underway
- Localized Caching — Where contractually required, FlitStack AI can localize metadata caching to specific jurisdictions, subject to subprocessor capabilities
8. Encryption & Security
| Measure | Standard |
|---|---|
| Data in Transit | TLS 1.2 or higher (all CRM, subprocessor, and customer traffic) |
| Data at Rest (temporary metadata) | AES-256 |
| Backups | AES-256, encrypted, stored on secure infrastructure (operational backups exclude CRM record data) |
| Key Management | Cloud key management services with automated rotation |
| Authentication Tokens | Time-limited, automatically rotated, encrypted in storage |
| Passwords | Never visible to or stored by FlitStack AI; managed via PropelAuth |
FlitStack AI employs a multi-layered security strategy combining encrypted communication channels, secure storage, automated vulnerability scanning, static and dynamic code analysis, peer code review, environment segregation, and infrastructure-as-code provisioning. Security practices are continuously evaluated through penetration testing, vulnerability scanning, subprocessor re-assessments, and regulatory monitoring.
9. Access Controls
- Role-Based Access Control (RBAC) — Access rights are tied to job responsibilities and enforced with strict separation of duties
- Least Privilege Principle — Users and services are granted only the access strictly required to perform their function
- Multi-Factor Authentication (MFA) — Mandatory for all privileged accounts (administrators, DevOps engineers, security personnel)
- Access Logging — All access events are logged, monitored, and reviewed periodically; access logs are continuously evaluated to enforce least-privilege principles
- Authentication Provider — Identity managed by PropelAuth, enforcing OAuth2, tokenization, session expiry, and SSO standards
- Background Checks — Pre-employment checks are performed for staff with privileged access
10. Subprocessors
FlitStack AI engages a carefully selected set of third-party service providers, referred to as subprocessors, to deliver secure, reliable, and compliant migration services. Each subprocessor is vetted for its security reputation, audited for compliance certifications, and bound by Data Processing Agreements (DPAs).
| Subprocessor | Purpose | Compliance |
|---|---|---|
| Amazon Web Services (AWS) Seattle, WA, USA | Core cloud infrastructure — compute, networking, and storage resources supporting in-memory data migration | ISO 27001, SOC 2, GDPR, HIPAA |
| Google Cloud (Firebase) Mountain View, CA, USA | Secure orchestration services, temporary metadata caching, and system monitoring | ISO 27001, SOC 2, GDPR |
| PropelAuth Redwood City, CA, USA | Authentication and identity management — RBAC, session tokens, MFA enforcement | OAuth2, SSO, GDPR-aligned |
| Sentry San Francisco, CA, USA | Error monitoring and exception tracking during migration processes | SOC 2; configured to exclude CRM records and PII |
| New Relic San Francisco, CA, USA | System performance monitoring, telemetry, and migration pipeline analytics | SOC 2; anonymization features enabled |
All subprocessors are reviewed annually through certification checks and contractual audits. Customers are notified of material changes to this subprocessor list in accordance with GDPR Article 28.
11. Data Retention & Deletion
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| CRM Record Data | None — processed in memory only, never persisted | Released from memory at end of migration session |
| Schema & Configuration Metadata | Duration of the migration + short reconciliation window | Cryptographic erasure |
| Operational & System Logs | 30–90 days depending on category | Automatic purge per defined retention schedule |
| Authentication Tokens | Duration of the active session | Automatic token expiry and rotation |
| Operational Backups | Per retention schedule (excludes CRM record data) | Secure cryptographic destruction |
Temporary metadata is deleted using cryptographic erasure methods, which render encrypted data unrecoverable by destroying the encryption keys. No CRM records remain in FlitStack AI systems after migration completion.
12. Your Rights
Under GDPR, CCPA, and applicable data protection laws, you have the following rights with respect to your personal information:
- Right of Access — Request a copy of the data we hold about you
- Right to Rectification — Request correction of inaccurate data
- Right to Erasure — Request deletion of schema metadata or authentication data associated with your account
- Right to Data Portability — Request export of your data in a machine-readable format
- Right to Restrict Processing — Request limitation of how we process your data
- Right to Object — Object to processing based on legitimate interests
- Right to Withdraw Consent — Withdraw consent at any time where processing is consent-based
Because FlitStack AI does not persist CRM records, most data subject rights requests are satisfied by virtue of our architecture. For requests concerning schema metadata, logs, or authentication data, contact [email protected]. We will respond within 30 days.
14. Incident Response
FlitStack AI maintains a documented incident response framework covering detection, containment, eradication, recovery, and reporting. Monitoring platforms provide real-time visibility into performance, anomalies, and security thresholds; automated alerts escalate suspicious activity for immediate review by engineering and security teams.
- Breach Notification — Customers and supervisory authorities are notified within 72 hours of a confirmed incident involving data processed through FlitStack AI
- Real-Time Monitoring — Sentry and New Relic provide continuous monitoring with automated alerts for anomalies
- Recovery Objectives — Recovery Time Objective (RTO) of 24 hours; Recovery Point Objective (RPO) of 12 hours for temporary metadata
- Disaster Recovery Testing — Regular disaster recovery drills ensure operational readiness
- Reporting — Security incidents are reported to [email protected]
15. Children's Privacy
FlitStack AI is a business-to-business service and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete the information promptly.
16. Changes to This Policy
This Policy is formally reviewed at least once every six months. Interim reviews may occur sooner if triggered by material changes to FlitStack AI's architecture or subprocessors, updates to global privacy and security regulations, or findings from internal audits, external assessments, or customer feedback.
The Chief Product Officer (CPO) is responsible for maintaining and updating this Policy; updates are reviewed and approved by ambrstack leadership, including the Chief Technology Officer (CTO). Each version is assigned a unique version number, with effective and last-updated dates appearing at the top of this page. Previous versions are retained for at least five years to provide historical compliance evidence. Customers are notified of material changes proactively.