GDPR Compliance by Design: The No-Database Approach
Most companies struggle with GDPR compliance. TopFlow is compliant by design—because it doesn't store any user data on servers. Here's how this radical approach works.
Updated June 17, 2026 — corrections
The original version said that not collecting data makes most GDPR requirements "irrelevant". That confused storing with processing. TopFlow stores no personal data, but it does process some briefly — and until this update its server logs held user input. The section below now says what is actually true, and what we changed.
The GDPR Compliance Challenge
For most companies, GDPR compliance is complex, expensive, and risky. The regulation spans 99 articles covering everything from consent management to data breach notifications. Non-compliance can result in fines of €20 million or 4% of global revenue—whichever is higher.
Typical GDPR Compliance Costs (rough industry estimates):
- Legal consultation: $10,000-50,000
- Compliance tools: $500-2,000/month
- Data protection officer: $80,000-150,000/year
- Ongoing monitoring and audits: $20,000-100,000/year
GDPR Article 5: Core Principles
GDPR's Article 5 establishes seven foundational principles for data processing:
Lawfulness, fairness, transparency
Process data legally with clear communication
Purpose limitation
Collect data only for specified purposes
Data minimization
Collect only what's necessary
Accuracy
Keep personal data accurate and up to date
Storage limitation
Retain data only as long as necessary
Integrity and confidentiality
Protect data from unauthorized access
Accountability
Demonstrate compliance
TopFlow's Compliance Approach
TopFlow's approach is simple: don't store personal data at all. Workflows and API keys live in your browser; there is no user database, no accounts, and no cookies.
Storing Nothing Shrinks the Problem — It Doesn't Erase It
With no stored personal data, the heaviest GDPR machinery has little to act on: there's no user database to secure, and no records to export or erase on request. But GDPR covers processing, not just storage. When you run a workflow, its content passes through our server for that request, and our host processes request data such as IP addresses to operate the service. That processing still needs a lawful basis, transparency, and a processor agreement with the host.
Logs Are Personal Data Too
The easiest way to store personal data by accident is a log line. Until this update, TopFlow's execution route printed user inputs and prompt text to server logs — which our platform retains. For a "no stored data" product, that broke data minimization (Article 5(1)(c)) without anyone deciding to.
We removed the content from the logs (they now record counts, IDs and error types) and added a test that plants a unique marker in every user-controlled field and fails the build if it ever reaches a log. If your privacy story is "we don't store data," make a test prove it — logs, error trackers and analytics included.
Conclusion
GDPR compliance doesn't have to be complex or expensive. By designing privacy into your architecture from day one, you shrink the problem dramatically — as long as you check every place data can land, including your logs.
TopFlow proves that privacy-first doesn't mean feature-poor. Experience it yourself at topflow.dev or review the architecture on GitHub.