Blog
Notes on automation
Practical writing on the systems we build, the tools we use, and what actually saves teams time.
EU AI Act and GDPR: what workflow-automation builders need to get right
GDPR didn't disappear because you added AI. A practical look at how the two frameworks overlap, and the design habits — like human-in-the-loop — that satisfy both at once.
Human-in-the-loop by design: why we never let AI auto-send
The most consequential decision in any AI automation isn't the model — it's whether a person reviews the output before it reaches a customer. Why we hold that line by default.
Zapier vs n8n vs Make: picking the right automation engine
Three real platforms, three different assumptions about complexity. A decision framework based on actual client workflows, not a feature-list comparison.
The no-API problem: scraping, headless browsers, and email as an API
Most legacy business tools don't have an API. Here's how headless-browser capture and email parsing turn closed systems into automatable ones — with the tradeoffs named honestly.
Sanity CMS vs Wix vs WordPress: how to actually pick
WordPress, Wix, and a headless CMS like Sanity make genuinely different tradeoffs on speed, flexibility, and who can edit what. Here's how to pick based on what your site actually needs to do.
The EU Accessibility Act: is your website actually compliant?
The EAA's main deadline already passed in June 2025. Here's who it applies to, what it actually requires, and why accessibility is cheaper as a design constraint than a retrofit.
Mistral AI and EU-hosted models: is "GDPR-compliant AI" real?
There's no certification that makes a model GDPR-compliant. What actually determines your compliance exposure — and where EU-hosted models like Mistral genuinely help.
Documenting your own automations so they don't become a black box
The more a business automates, the easier it is for the knowledge of how it all fits together to live in one person's head. Here's what we built instead of a wiki nobody updates.
Automation ROI: how we measure hours saved, honestly
Most automation pitches come with an optimistic number attached. Here's the discipline behind ours: every figure traces to a specific, timed process — nothing invented, nothing rounded up.
Do you actually need a vector database?
Vector databases solve unstructured search. Most business questions are structured lookups a spreadsheet already answers. How to tell the difference before you build unnecessary infrastructure.
Cloudflare Turnstile vs Altcha vs reCAPTCHA: picking a captcha you can defend
Every form needs bot protection, and almost nobody thinks about which kind. Here's the real tradeoff between Google's reCAPTCHA, Cloudflare's Turnstile, and a self-hosted option like Altcha.
Inside Shai-Hulud: what the npm supply-chain worm means for your site
A self-replicating worm compromised 500+ npm packages by stealing maintainer credentials and using them to infect more packages automatically. Here's what happened and what to actually do about it.
Retrieval-augmented generation, explained without the buzzwords
RAG is a simple idea buried under jargon: find the real answer first, then let the model write from it. A step-by-step walkthrough using a real support-email agent.
AI orchestration, explained without the hype
Calling a model isn't orchestration. Orchestration is sequencing lookups, tools, and review steps around the model — and it usually matters more than which model you picked.
Headless CMS, or build your own? Two of our own projects, compared
This site runs on a headless CMS. TG Spaces runs on a custom-built admin panel. The difference comes down to one question: is what changes here content, or behavior?
Welcome to the Flowstate Works blog
Practical notes on the automations we build, the tools we use, and what actually saves teams time.
Curious what AI could realistically take off your plate?
Take back your time. We automate the manual tasks so you stay in control. Schedule a chat today.