Security Center
Your data will always be yours!
[Flux Architecture Graph]
Overview
We enable engineers and organizations to maximize their potential by prioritizing security, privacy, compliance, and transparency as we develop and iterate on Flux.
Flux and security
Flux uses top-notch infrastructure and encryption.
Secure transmission/encryption
Flux transmits data to Flux's LLM tenants to generate suggestions, including both contextual data about the project being edited ("prompts") and data about the user's actions ("user engagement data"). The transmitted data is encrypted both in transit and at rest; Flux-related data is encrypted in transit using transport layer security (TLS), and for any data we retain at rest using data encryption (FIPS Publication 140-2 standards).
Third-party testing/certification
Audits and Certifications: Flux is not currently included in Flux's existing audits and certifications, including SOC 2. Compliance at Flux begins with good security, so our first focus is fully onboarding Flux to Flux security programs and tooling. Flux is engaging with a third-party audit firm to perform a gap assessment of Flux as part of readiness activities for SOC 2 Type 1 (security criteria), with a goal of having the full audits by June 2024, and will start onboarding new Flux GA'd functionality on a 6 month cycle starting in November 2024.
Limitations of Flux
While our experiments have shown that Flux suggestions are of the same or better quality than the average engineer, we can't give any assurance that it's error free. Like any engineer, Flux may sometimes be wrong. We recommend taking the same precautions you take with work done by your engineers (Reviews, Audits, etc.)
Flux and privacy
Your privacy is paramount. We're committed to handling your data responsibly, while delivering an optimal Flux experience.
What personal data does Flux process?
Flux processes personal data based on how Flux is accessed and used. Users can access Flux through the web or API on flux.ai. The types of personal data processed may include:
User Engagement Data: This includes pseudonymous identifiers captured on user interactions with Flux, such as accepted or dismissed completions, error messages, system logs, and product usage metrics.
Prompts: These are inputs for chat, along with context, sent to Flux's AI to generate suggestions.
Suggestions: These are the AI-generated chat responses provided to users based on their prompts.
Feedback Data: This comprises real-time user feedback, including reactions (e.g., thumbs up/down) and optional comments, along with feedback from support tickets.
How does Flux use the data?
How Flux uses data depends on how the user accesses Flux and for what purpose. Users can access Flux through the web or API on flux.ai. Flux generally uses personal data to:
Deliver, maintain, and update the services as per the customer's configuration and usage, to ensure personalized experiences and recommendations
Troubleshoot, which involves preventing, detecting, resolving, and mitigating issues, including security incidents and product-related problems, by fixing issues and maintaining the services' functionality and up-to-dateness
Enhance user productivity, reliability, effectiveness, quality, privacy, accessibility, and security by keeping the service current and operational
For details on Flux's data processing activities refer to the Flux Privacy Statement.
Does Flux use Enterprise data to train Flux's model?
No. Flux does not use Flux Enterprise data to train its models.
How long does Flux retain data for enterprise customers?
If and for how long Flux retains data depends on how a Flux user accesses Flux and for what purpose. The default settings for Flux Enterprise Customers are as follows:
Access through web or API on flux.ai for Chat:
Prompts and Suggestions: Retained for the lifetime of the Chat message.
User Engagement Data: Kept for two years.
Feedback Data: Stored for as long as needed for its intended purpose.
All other Flux access and use:
Prompts and Suggestions: Retained for the lifetime of the data.
User Engagement Data: Kept for two years.
Feedback Data: Stored for as long as needed for its intended purpose.
Does Flux use third-party subprocessors?
Yes. Flux shares data with third parties acting as our subprocessors (as defined in the GDPR) to support operations. Any subprocessors to which Flux transfers personal data will have entered into written agreements with Flux that are no less protective than the Flux Privacy Statement. All third-party subprocessors are listed at https://docs.flux.ai/legal/subprocessors
IP and Open Source
Respecting intellectual property rights is an important part of the hardware development process. Learn about data ownership, and public data use here.
Does Flux "copy/paste"?”?
No, Flux generates suggestions using probabilistic determination and a knowledge graph.
When thinking about intellectual property and open source issues, it is critical to understand how Flux really works. The AI models that create Flux's suggestions may be trained on public data, but do not contain any specific IP. When they generate a suggestion, they are not "copying and pasting" from any public data.
To generate a suggestion, Flux begins by examining the schematic, pcb layout, user code, components and other data in your project—focusing on current context, but also including other information in your project and the URLs of datasheets, application notes and other relevant information to identify relevant context. That information is sent to Flux's model, to make a probabilistic determination to generate suggestions from world knowledge and/or the Flux knowledge graph.
To generate a suggestion for chat on flux.ai, such as providing an answer to a question from your chat prompt, Flux creates a contextual prompt by combining your prompt with additional context including previous prompts, the open project on flux.ai as well as retrieved context from your org/account projects. That information is sent to Flux's model, to make a probabilistic determination to generate suggestions from world knowledge and/or the Flux knowledge graph.
What are the intellectual property considerations when using Flux?
The primary IP considerations for Flux's underlying machine learning models relate to copyright. The model that powers Flux is trained on a broad collection of publicly accessible information, which may include copyrighted material, and Flux's suggestions (in rare instances) may resemble the information its model was trained on. Here's some basic information you should know about these considerations:
Copyright law permits the use of copyrighted works to train AI models: Countries around the world have provisions in their copyright laws that enable machines to learn, understand, extract patterns, and facts from copyrighted materials, including hardware designs. For example, the European Union, Japan, and Singapore, have express provisions permitting machine learning to develop AI models. Other countries including Canada, India, and the United States also permit such training under their fair use/fair dealing provisions. Flux's AI model was trained with the use of data from Flux's public projects—which are publicly accessible and within the scope of permissible copyright use.
What about copyright risk in suggestions? In rare instances (less than 1% based on Flux's research), suggestions from Flux may match examples of information used to train Flux's AI model. Again, Flux does not "look up" or "copy and paste" information, but is instead using context from a user's workspace to synthesize and generate a suggestion. Our experience shows that matching suggestions are most likely to occur in two situations: (i) when there is little or no context in the project for Flux's model to synthesize, or (ii) when a matching suggestion represents a common approach or method. If a suggestion matches existing solutions, there is risk that using that suggestion could trigger claims of copyright infringement, which would depend on the amount and nature of solution used, and the context of how the solution is used. In many ways, this is the same risk that arises when using any solution that a engineer does not originate, such as copying a solution from an online source, or reusing a solution from a textbook. That is why responsible organizations and engineers recommend that users employ policies to identify and evaluate potential matching solutions.
Since electronics design is functional in nature and neither PCB designs, nor the functional aspects of schematic designs are protected by copyright in most jurisdictions, the overriding consideration with IP of EDA projects relates to patents. The legal landscape is still evolving toward further integration AI in various frameworks. At the time of writing it’s our understanding that most major legal systems, including US patent law, allow for the filing of patent applications for inventions that were co-created between humans and AIs, provided that the human contributions to the invention are non-trivial and that only humans are named as inventors.
What about open source license considerations?
When a engineer uses information made available under an open source license, they may have to meet license requirements, such as attributing the author of the project, disclosing the project that makes use of open source information, or distributing the project under certain licenses. If these requirements are not met, the owner of the project could assert claims including copyright infringement or breach of the applicable open source license.
Does a suggestion that matches automatically trigger copyright or open source considerations? No. The existence of matching information does not itself dictate whether the concerns and their legal risk exist. Whether and when these considerations may apply depends on many factors, including the quantity and nature of the open source data used, and the specific open source license applicable to such project. As with any solutions that your engineers did not originate, the decision about when, how much, and in what context to use any solution is one your organization needs to make based on its policies, and in consultation with industry and legal service providers. All organizations should maintain appropriate policies and procedures to ensure that these licensing concerns are properly addressed, as described below.
Discussing all possible concerns and safeguards around open source is beyond the scope of this document. If your organization is using Flux, however, you are likely already developing hardware, policies, and procedures around open source. You should apply them equally to solutions suggested by Flux.
Each organization is responsible for setting its open source policies and procedures.
Is Flux intended to fully automate hardware design generation and replace engineers?
No. Flux is a tool intended to make engineers more efficient. It's not intended to replace engineers, who should continue to apply the same sorts of safeguards and diligence they would apply with regard to any third-party solutions of unknown origin.
The product is called "Flux" not "Autopilot" and it's not intended to generate suggestions without oversight. You should use exactly the same sorts of safeguards and diligence with Flux's suggestions as you would use with any third-party information.
Identifying best practices for use of third party solutions is beyond the scope of this section. That said, whatever practices your organization currently uses – rigorous functionality testing, reviews, security testing, etc. – you should continue these policies with Flux's suggestions.
Can Flux users simply use suggestions without concern?
Not necessarily. Flux users should align their use of Flux with their respective risk tolerances.
As noted above, Flux is not intended to replace engineers, or their individual skill and judgment, and is not intended to fully automate the process of hardware development. The same risks that apply to the use of any third-party solutions apply to the use of Flux's suggestions.
Depending on your particular use case, you should consider implementing the protections discussed above. It is your responsibility to assess what is appropriate for the situation and implement appropriate safeguards.
How does Flux use your data to provide suggestions?
Flux provides suggestions based on the context of what you're working on in your Flux project on flux.ai. This requires temporarily transferring an ephemeral copy of various elements of that context to Flux's servers.
Generative AI tools provide responses to something generically called a "prompt." In the case of Flux, the prompt consists of various elements from your Flux project and its dependencies. This may include file content both in the project you're editing, as well as neighboring or related projects. It may also include URLs of datasheets or application notes to identify relevant context. This information, along with this context, is then used to synthesize and suggest solutions.
The prompt needs to be transferred to Flux’s servers for processing. The transmitted data is encrypted, both in transit and at rest.
Flux interacts with its model and knowledge graph, to generate suggestions. These suggestions are then transmitted back to the user. As above, the suggestions are encrypted in transit and at rest.
Prompts are transmitted in real time only to return suggestions. If you are using Flux, your prompt, suggestion, and supporting context will be stored for the lifetime of your project.
Does Flux use any of your data to train the Flux's model (or any successor model)?
No. Flux does not use Flux Enterprise data to train the Flux model.
Who owns the suggestions provided by Flux?
We do not determine whether a suggestion is capable of being owned, but we are clear that Flux does not claim ownership of a suggestion.
Whether a suggestion generated by an AI model can be owned depends on many factors (e.g. the intellectual property law in the relevant country, the length of the suggestion, the extent that suggestion is considered ‘functional’ instead of expressive, etc).
If a suggestion is capable of being owned, our terms are clear: Flux does not claim ownership.
In certain cases, it is possible for Flux to produce similar suggestions to different users. For example, two unrelated users both starting new projects to design a voltage divider will likely get similar or same suggestions. The possibility of providing similar suggestions to multiple users is a common part of generative AI systems. Regardless, Flux does not claim ownership.