Security & data handling
Where does my drawing go?
This is the question aerospace and manufacturing quality engineers ask first, so it comes first. When you analyse a drawing with ASdrawn, the file is processed transiently, in memory. It is never written to our storage and never used to train AI models. Only the extracted results — characteristics, dimensions, tolerances, workbook data — are saved to your account. Everything below is a plain-language expansion of our privacy policy; the policy is the authoritative version.
Where does your drawing travel?
The drawing file never leaves your browser as a whole. During analysis, regions of it move through a short, encrypted path and are gone from memory when the run finishes:
- 01
Your browser
The drawing file stays in your browser's storage on your device. Our servers receive only a SHA-256 content hash and metadata — never the file itself.
- 02
ASdrawn's inference service
During analysis, regions of the drawing travel from your browser to our inference service, hosted on cloud infrastructure in Australia (Sydney region). They are held transiently in memory, never written to storage, and every hop is encrypted (HTTPS/TLS).
- 03
Cloud AI analysis
The regions are analysed by our cloud AI provider, at the endpoint your workspace owner selects. Our provider does not use data submitted through the service to train its models. Text recognition (OCR) runs on the same provider's cloud service.
- 04
Your account (Convex)
Only the outputs — extracted characteristics, dimensions, tolerances, and workbook data — are written to your account database, hosted in the United States. These describe what was found; they are not the drawing.
Each analysis run records the actual AI inference and OCR locations used, so the processing location of every run is auditable.
Who else touches the data?
We rely on a small, fixed set of subprocessors, each bound by their own data-protection terms. This is the complete list — the same one named in our privacy policy:
| Party | Role | Where |
|---|---|---|
| Vercel | Application and marketing-site hosting; cookieless site analytics. | United States + global CDN |
| Convex | Application database — account, analysis, and billing records (extracted results, not drawings). | United States |
| Cloud AI provider | AI inference and text recognition (OCR), and the cloud infrastructure our inference service runs on. | Australia (Sydney) for our inference service; AI/OCR endpoint your workspace selects |
| WorkOS | Authentication and sign-in. Does not receive drawing content. | United States |
| Stripe | Payment processing. Does not receive drawing content. | United States |
| Cloudflare | DNS and network security for this website. Does not receive drawing content. | Global (DNS/edge) |
Some of these providers store data outside Australia (primarily in the United States). None of the account, sign-in, or billing providers receive your drawing content. Signed-in customers can see the specific vendors and the full component-by-component processing detail in the app, under About & infrastructure.
What about export-controlled data (ITAR / EAR)?
Talk to us before uploading anything export-controlled. Our terms put responsibility for the rights to process a drawing — including any export-control or confidentiality obligations you carry — with you, the uploader. Because inference can run in more than one jurisdiction, we will walk you and your compliance owner through exactly where data is processed and stored so you can make the call before anything is uploaded.
To be direct about what this is and is not: ASdrawn does not claim ITAR compliance, and we make no US-person handling guarantee. This is a policy — controlled data requires a conversation first — not a certified capability.
Does the demo ever see my data?
No. Our interactive demo runs entirely on a synthetic fixture drawing that we own. It is read-only: there is no upload, no file picker, and it talks to no analysis backend. Evaluating what ASdrawn does never involves one of your drawings — you only put a real drawing through the pipeline once you have signed in and chosen to.
Where do you draw the line on responsibility?
ASdrawn assists inspection planning and FAIR preparation; it does not replace review by a qualified person. AI vision output can be incomplete or wrong — a missed characteristic, a misread tolerance — so human review is the workflow, not a footnote:
- Every output is shown beside its source callout for a qualified person to verify before it is used in any inspection, certification, or delivery decision.
- ASdrawn is not a certified measurement device, and its output is not itself evidence of conformance.
- Nothing ships unreviewed: sign-off is a deliberate, human step in the editor.
How long is anything kept, and how do I delete it?
- Analysis results and their records are kept until you delete them. Permanently deleting an analysis removes its data from our systems.
- Drawings stored in your browser are under your control and can be cleared from the dashboard or your browser settings at any time.
- Account and billing records are kept while your account is active, plus any period required by tax and accounting law.
- We keep encrypted backups of our database for disaster recovery for up to 30 days. Deleted data disappears from live systems immediately and from backups as they expire; backups are used only to restore the service, never to recover data you have deleted.
On our own posture: all traffic is encrypted in transit (TLS), access to production systems is restricted and credentialed, secrets are managed outside source code, and administrative access to customer data is limited to what support requires. To be straight with you, ASdrawn does not yet hold a formal third-party security certification; the practices above are the current state, and this page will say so honestly as that changes.
Still have a security question?
The full, authoritative detail lives in the privacy policy. For anything a security or compliance review needs that is not answered here, email admin@xponentialautomation.com and a person who builds ASdrawn will answer.