Security

Your designs are your intellectual property. We keep them private by default and build the product so that access is checked at the data layer, not only in the interface. This page lists what is in place today and, separately, what is still planned, so you can judge us on facts.

• Data isolation: row-level security on every table, so each query is limited to the workspaces a person belongs to. Isolation tests run as part of our build.
• Private files: uploads, renders, exports, drawings and concept images live in private storage and are shared only through short-lived signed links.
• Sign-in: email and password, magic link or code, passkeys, and two-step verification (authenticator app or security key). A device list lets you sign any device out remotely.
• Abuse protection: rate limiting on sign-in, AI and export endpoints, and bot protection on sign-up and the homepage try-it box.
• Secrets: API keys stay on the server and are never shipped to the browser; the AI provider key is kept in an encrypted secrets vault.
• Audit trail: sign-ins, shares, exports and permission changes are logged and visible to workspace admins.
• Your control: self-serve data export and account deletion, share links with expiry and passwords, and no model training on your designs without opt-in.
• Data is encrypted in transit and at rest by our infrastructure providers (see the subprocessor list).

• Virus scanning of uploads and stricter file-type validation.
• SOC 2 Type II and ISO 27001 for pro and enterprise buyers.
• Enterprise single sign-on (SAML), SCIM provisioning, domain capture and enforced two-step verification.
• External penetration tests before general availability, plus continuous dependency scanning.
• Watermark options on shared renders and drawings.

We will not describe a certification as held until it is.

If you think you have found a security problem, please write to [email protected] with the details. Please give us reasonable time to fix it before you share it publicly, and don't access data that isn't yours. We will acknowledge your report and keep you updated. [Disclosure policy and safe-harbour wording to be confirmed with counsel.]