Security

Each account can reach only its own projects and files. That rule is enforced by access rules in the database itself, and an automated test checks them before each release. Downloads from active storage use private links that expire shortly after they're made. Files that have moved to the archive are reached through a link containing a long random code, so anyone you share an archive link with can download that file.

We don't use your drawings to train AI models, and we never show one customer's files to another. The subprocessor list shows who handles your data and what each one receives.

Every connection to AutoMEP uses HTTPS, and browsers are told to refuse a plain HTTP connection. In active storage, drawings and the files we produce are encrypted at rest by our storage provider. Files we move to the archive travel over an encrypted connection.

Passwords are stored only as salted hashes, so we can't read them. New accounts confirm their email address before they can sign in, and sign-in and password reset are rate-limited. You can also sign in with Microsoft or Google, which lets your organization's own sign-in policy, including multi-factor authentication, apply to AutoMEP.

Payments go through Stripe's hosted checkout. Card numbers are entered on Stripe's page and never reach our servers.

The website and its forms sit behind Cloudflare, which absorbs denial-of-service attacks and screens bots. Our application server runs a firewall that exposes only what the service needs, and repeated failed sign-in attempts to the server are blocked automatically. Passwords and keys are kept out of the website code and out of source control.

Every change passes an automated suite of checks before it ships, including tests that confirm each database table refuses access it shouldn't allow. Each commit is scanned for accidentally included passwords or keys before it's saved.

Every scheduled job alerts us if it fails. We keep a written incident response plan. If a security breach affects your personal data, we'll tell you without undue delay after we confirm it.

The database is backed up every night, and each week a backup is restored to prove it works. Your drawings and their outputs stay in active storage for thirty days, then move to an archive so that a file you paid to have processed isn't lost. You can delete your account and its files yourself from Settings. The Privacy Policy explains exactly what deletion removes and the two limits on it.

We don't hold a SOC 2 report or an ISO 27001 certificate today. Here's what we do have, ready for a vendor review:

• A published subprocessor list.
• A listing in the Cloud Security Alliance STAR Registry (Level 1), with our completed CAIQ, the industry-standard cloud security self-assessment, published there for anyone to read.
• An accessibility conformance report.
• Card payments handled entirely by Stripe, a PCI DSS Level 1 service provider.

If your firm has its own security questionnaire or needs a Data Processing Addendum, ask through the Help Center.

If you think you've found a vulnerability, tell us through the Help Center and include the steps to reproduce it. We read every report and reply. We don't run a paid bug bounty. Our security.txt file has the same details.