Security & Data Handling
⬇ Download this policy as a PDF (vendor review document)
Most of our users work under customer NDAs. This page explains — precisely — what happens to a drawing when you use CadNexa: what stays on your computer, what is transmitted, what is stored, and for how long.
1. Two processing models
| What you use | Where processing happens | Does the file leave your computer? |
|---|---|---|
| 3D Viewer (STEP / IGES / STL / OBJ…) — viewing, measuring, BOM, exploded views, compare | 100% inside your browser (WebAssembly) | No — never. The file is opened locally and is not uploaded anywhere. |
| 2D Sketch — drawing, dimensions, PDF/DXF export | 100% inside your browser | No — never. |
| Auto-Balloon (PDF/image drawings → FAI report) | Your browser + transient AI processing (details below) | Rendered page images are transmitted encrypted for AI detection, then discarded. |
2. Auto-Balloon: the exact data flow
When you run auto-detect on a drawing:
- The PDF file itself is not uploaded. It is opened and rendered into page images inside your browser.
- For AI detection, the rendered page image is transmitted over encrypted HTTPS (TLS 1.2+) to two processors:
- CadNexa's OCR service (our own service on Google Cloud): processes the image entirely in memory, returns text positions, and writes nothing to disk or storage. The service is stateless; request data is discarded when the response is sent — memory lifetime is the duration of the request (seconds).
- Anthropic's Claude API (AI dimension detection), accessed via our secure server-side proxy so no keys or data are exposed client-side. Under Anthropic's commercial API terms, customer inputs are not used to train models; Anthropic may retain API data for a limited period (up to ~30 days) solely for trust-and-safety monitoring, after which it is deleted. See Anthropic's commercial terms.
- CadNexa stores no drawings. No drawing image, page, or PDF is written to any CadNexa database or storage bucket — there is no code path that does so.
- Detection results (dimension text + coordinates — not the drawing) are cached in your own browser (IndexedDB) so re-opening the same drawing is instant and free. That cache lives on your machine and you can clear it via your browser at any time.
- Your finished ballooned PDF / FAI report is generated in your browser and downloads directly to your computer. We never receive a copy.
3. Drawings are never used for AI training
CadNexa does not retain, share, sell, or use your drawings to train any AI model — ours or anyone else's. Our AI subprocessor (Anthropic) is contractually barred from training on customer API data under its commercial terms. We deliberately removed in-product training-data collection: there is no toggle, no opt-out to find — the capability does not exist in the product.
4. What we do store
| Data | Where | Retention |
|---|---|---|
| Account identity (name, email from Google sign-in) | Managed Postgres (Supabase, hosted on AWS), encrypted at rest | Until you ask us to delete your account |
| Subscription & billing metadata (plan, status — never card details) | Same database; card data is handled solely by Razorpay (PCI-DSS Level 1) | Duration of the account + statutory accounting periods |
| Usage counters (e.g. "a drawing was processed", page counts) — metadata only, never drawing content | Same database | Rolling analytics window |
| Your drawings / CAD files / reports | Not stored. | — |
| RFQ attachments (only if you explicitly use the RFQ sharing feature) | Private storage bucket, access-controlled signed URLs | Until you delete the RFQ |
5. Access control & encryption
- In transit: all traffic uses HTTPS/TLS 1.2+.
- At rest: the account database is encrypted (AES-256) on AWS infrastructure via Supabase.
- Row-Level Security: database policies ensure every account can only ever read its own rows — enforced by the database itself, not application code.
- Authentication: Google OAuth only. CadNexa never sees or stores passwords.
- Internal access: administrative access is restricted to the founder's account, enforced at the database-policy level.
6. Subprocessors
| Provider | Purpose | Certifications |
|---|---|---|
| Google Cloud | OCR compute (stateless, in-memory) | ISO 27001, SOC 1/2/3 |
| Anthropic | AI dimension detection (no-training commercial terms) | SOC 2 Type II |
| Supabase (on AWS) | Account database & authentication | SOC 2 Type II; AWS ISO 27001 |
| Razorpay | Payments & subscriptions | PCI-DSS Level 1 |
| Netlify | Static site hosting | SOC 2 |
7. Certifications — an honest note
CadNexa is an early-stage product and does not yet hold its own ISO 27001 or SOC 2 certification; the infrastructure it runs on (above) does. Our security posture is built on a simple architectural principle instead: the most confidential data — your drawings and CAD files — is either never transmitted at all, or processed transiently and never stored. A formal certification program is on our roadmap as the company grows.
8. NDAs and security questionnaires
Evaluating CadNexa under a customer NDA? We're happy to sign a mutual NDA and to complete your organisation's vendor security questionnaire. Write to us at the address below. If your policy requires it, you can also evaluate using a non-confidential or sanitised drawing first — the workflow is identical.
Security contact
support@cadnexa.com — reaches the founder directly.
Report a vulnerability or ask a data-handling question — we respond fast, usually the same day.