Why I Built an AI App Without a Database (And You Might Too)

The Default Path

Most SaaS applications follow a predictable pattern: collect user data, store it in PostgreSQL, analyze usage patterns, and monetize through subscriptions. It's the established playbook, and for good reason—it works.

But this default path comes with significant baggage: GDPR compliance requirements, data breach risks, encryption complexity, backup strategies, and the ongoing responsibility of protecting user information.

"Every major SaaS breach started with 'we store user data securely.' The question isn't if you'll be breached, but when."

The Privacy-First Alternative

TopFlow takes a radically different approach: zero server-side data storage. User workflows live entirely in the browser's localStorage, and execution happens in a stateless, request-scoped context.

How It Works

• Client-side storage: Workflows and API keys are saved only in your browser's localStorage (keys AES-256-GCM encrypted)
• Stateless execution: When you run a workflow, it and the keys it needs are sent over HTTPS to our server, used in memory for that one request, and never stored or logged
• Ephemeral rate limiting: Redis holds an HMAC-hashed form of your IP for about a minute (one rate-limit window), then it expires
• Nothing stored = nothing to breach: With no user database, there's no stored personal data to steal

Real-World Implementation

This isn't just theory. Here's how TopFlow implements privacy-first architecture in production with Next.js and TypeScript:

Saving a workflow writes to localStorage (lib/storage.ts):

localStorage.setItem("ai-agent-workflows", JSON.stringify(workflows))

Running one sends the graph — and your keys — to the execution route for that request only (components/execution-panel.tsx):

const response = await fetch("/api/execute-workflow", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ nodes, edges, apiKeys: keys, workflowId, userInputs /* … */ }),
})

The server executes the workflow in memory and streams results back. Nothing is written to a database — there isn't one — and a test plants a unique marker in every user-controlled field and fails the build if it ever appears in server logs (log-privacy.test.ts). That test exists because, until this update, our logs did contain user input.

GDPR Compliance: Much Simpler

Here's the beautiful part: when you don't store data, GDPR compliance becomes dramatically simpler:

• Article 5 (Data Minimization): ✅ We don't store personal data; workflow content is processed only in memory, for the length of a request
• Article 15 (Right to Access): ✅ Users already have their data (it's in their browser)
• Article 17 (Right to Erasure): ✅ Users can delete their data anytime (clear localStorage)

Trade-offs & When This Works

This architecture isn't for everyone. Here's when it makes sense:

The Results

TopFlow's privacy-first architecture delivers tangible benefits:

• Zero stored-data breaches: Can't lose data you never stored
• Privacy by design: Far fewer obligations — no user database to secure, no export or deletion workflows to build
• $0 database costs: Saves ~$50-100/month in infrastructure
• User trust: Users control their own data, always

Try It Yourself

Experience privacy-first architecture in action. Visit topflow.dev and build an AI workflow — no signup, no cookies. The full source (including the localStorage abstraction and AES-256-GCM key encryption) is on github.com/csupenn/topflow.