What is Flowise?
Flowise is an open-source platform for visually building generative-AI applications, LLM workflows, and agents. A team connects models, prompts, retrievers, document stores, tools, APIs, and control nodes on a canvas, then exposes the result through chat, an embed, or the Prediction API. It can run on infrastructure you control or through Flowise Cloud.
The distinction matters. Flowise is an orchestration layer, not a model and not an end-to-end privacy boundary. A workflow can send data to a model provider, store embeddings in an external vector database, retain uploaded files in local or cloud object storage, call connected business systems, and send analytics elsewhere. The visual canvas makes those components easier to combine; it does not remove their cost, permissions, failure modes, or terms.
Agentflow V2 and workflow design
Agentflow V2 is Flowise's newer native orchestration architecture. Its standalone nodes make branching, loops, iteration, LLM calls, tool calls, retrieval, agents, subflows, and state movement explicit. A supervisor can delegate to worker agents, and nodes can read or update declared flow state. The platform also supports MCP tools and server-sent event streaming.
Human-in-the-loop controls are useful for consequential work. A Human Input node can pause execution for approval or feedback and resume from a saved checkpoint, including after an application restart. Individual agent tools can require human input before execution. These mechanisms reduce risk only when the reviewer sees enough context, understands the action, and cannot be bypassed by another route.
Do not convert every task into an autonomous agent. Use deterministic nodes for fixed transformations and validation, retrieve only from authorized sources, give agents a narrow tool list, and place approval before irreversible actions. Pin versions and test migrations: the documentation says Agentflow V1 is being deprecated, and V2 behavior can change across releases.
Cloud pricing and the real self-hosting cost
Flowise Cloud's public price table lists Starter at $35 monthly, including unlimited flows and assistants, 10,000 predictions per month, 1 GB storage, and community support. Pro is $65 monthly for 50,000 predictions, 10 GB, unlimited workspaces, five users, roles and permissions, and priority support; extra users are listed at $15 each monthly. Enterprise is custom and advertises on-premises or air-gapped deployment, SSO/SAML, LDAP/RBAC, versioning, audit logs, a 99.99% uptime SLA, and personalized support.
The community repository is a separate cost model. Its source is described as Apache-2.0 licensed, with enterprise code commercially licensed. Self-hosting avoids the Cloud subscription but adds compute, database, storage, load balancing, secrets, TLS, backups, upgrades, monitoring, incident response, and staff. Model tokens, embeddings, reranking, OCR, vector search, external APIs, and egress can dominate the bill in either route.
Compare cost per approved outcome, not only price per prediction. Load-test realistic documents and concurrency, measure latency and model retries, and price both successful and failed executions. Confirm which Cloud or Enterprise features are contractual entitlements; for example, the evaluation feature is documented as Cloud and Enterprise only.
Access control and public-flow risk
Flowise's official flow-authorization page contains a critical default: after you construct a Chatflow or Agentflow, the flow is public. Anyone with its ID can run predictions through the embed or API until you assign a flow-level API key. An unpredictable ID is not access control.
Protect every nonpublic flow before adding real credentials or documents. Apply flow-level keys, instance authentication, network restrictions, least-privilege service accounts, origin controls, secret rotation, request-size limits, and tested rate limiting. Flowise notes that proxy configuration affects IP-based limits. Keep build, test, and production instances separate, and ensure an embedded front end does not expose a reusable secret.
The Prediction API supports session memory, files, streaming, and configuration overrides. Dynamic overrides are disabled by default for security; keep them limited to an allow-list. Treat prompts, uploaded files, retrieved text, web results, and connector content as untrusted input. Test prompt injection, tool-argument manipulation, data exfiltration, cross-session memory, oversized files, retry loops, and cost exhaustion.
Credentials, storage, and deletion boundaries
Flowise stores third-party API keys as encrypted credentials. By default it creates and stores a local encryption key; documentation warns that changing or regenerating the key can make credentials undecryptable. Production teams should establish a stable secret-management and rotation process, restrict filesystem access, back up the key separately from encrypted data, and use supported external secret management where appropriate.
The default database can be local SQLite, while production deployments can use PostgreSQL or MySQL. Uploaded documents, images, audio, and other files may live in local storage or configured object storage. Document embeddings may live in a separate vector database. Deleting a Flowise document-store configuration or chunks does not necessarily delete records from that external store, so a defensible deletion process must cover the application database, object store, vector index, logs, backups, model providers, and every connected system.
Flowise's privacy policy says Cloud uses services including PostHog and Stripe, stores Cloud data in the US East region, and retains information as necessary; anonymized data may be retained indefinitely. It states that self-hosted use sends Flowise no metrics or data. That does not mean a self-hosted workflow is offline: the operator's chosen model, vector, analytics, and connector services can still receive data.
The terms say users retain ownership of User Content while licensing Flowise to host and process it to operate and improve services; anonymized and aggregated usage may improve the platform. The public pages do not provide a universal, detailed promise covering prompt training and retention across every Cloud feature and model provider. Sensitive buyers should obtain a DPA, subprocessor and model list, retention schedule, region, deletion commitments, incident terms, audit evidence, and any no-training commitment in the governing contract.
Verdict
Flowise is a capable bridge between code-heavy agent frameworks and closed no-code products. It gives technical teams a visual way to assemble retrieval and tool-using systems, exposes practical APIs, and preserves a self-hosting path. Agentflow V2's explicit controls and human checkpoints are especially useful when workflows need more than a linear chain.
Its flexibility creates operational responsibility. The most important deployment fact is that flows are publicly callable by ID unless protected. The most important privacy fact is that data can cross several services beyond Flowise. Start with a non-sensitive, read-only workflow; protect it before connecting credentials; build an end-to-end data map; test adversarial inputs and deletion; then add tools and autonomy only when monitoring and accountable approval are working.
