L-004
Security
Effective August 18, 2026. Controls actually in place for Drawing Logic HQ — not a marketing checklist.
Authentication and access
Sign-in uses Supabase Auth with server-validated sessions. Cookies are HTTP-only. Paid self-serve signups and invited teammates are approved automatically. Uninvited joins of someone else's workspace stay pending until a platform or organization administrator approves them.
Roles are assigned on the server. The browser is never trusted as the source of permissions. Organization data is queried with the authenticated organization id.
Drawings and files
Object storage keys are namespaced per organization. Buckets are private. Downloads use short-lived signed URLs.
Uploads are checked for size, declared type, magic bytes, sanitized names, and checksums. When a malware scanner is configured, files are scanned before they are trusted.
Application isolation
Missing and foreign records both return not-found to reduce id guessing. Database policies restrict direct table access from anonymous and authenticated Supabase roles; the app talks through authorized server services.
Cookie-authenticated API mutations require same-origin validation. Registration and mutations are rate-limited.
Encryption in transit
Customer data is encrypted in transit with TLS 1.2 minimum (TLS 1.3 preferred). Production traffic is HTTPS-only: HSTS, upgrade-insecure-requests, and HTTP-to-HTTPS redirects. Database, object storage, and worker connections negotiate TLS 1.2 or higher. Plain HTTP is limited to local loopback during development.
Encryption at rest
Customer data is encrypted at rest with AES-256 in every environment, including preview and local non-production. Postgres volumes use provider AES-256. Object storage writes use S3 SSE-S3 AES-256. Application secrets, backup dumps, in-memory non-prod objects, and optional log archives use AES-256-GCM with DATA_ENCRYPTION_KEY.
Integration secrets are encrypted at rest with AES-256-GCM. Encrypted values are not sent to the browser. Logs redact tokens, passwords, and signed URLs.
AI assistance
Organization admins can turn AI chat and generative tools off under Company settings. Drawings stay in private storage. Detection, takeoff, and processing workers stay on.
Secrets and browser policy
Production responses set CSP, HSTS, frame denial, and related browser isolation headers.
Report a problem
Write to sales@drawinglogichq.com with “Security” in the subject. Do not attach live customer drawings to the report unless we ask.
Where drawings go
Company admins can turn AI assistance off. Chat, inspect, and generative tools then stop. Sheets stay in your storage and processing worker.
| Data | Where it is processed | Leaves your workspace? | Public model training? |
|---|---|---|---|
| Drawings and sheets | Private object storage, keys namespaced per organization | Only if AI assistance is on (chat / inspect tools) | No |
| Detections, takeoff, forms | Application database and your processing worker | No | No |
| Account identity | Supabase Auth | Identity provider only | No |
| Billing | Stripe | Payment processor | No |
| AI chat and inspect | The model provider your workspace has configured | Yes, when company AI assistance is on | No — we do not use customer drawings to train public models |
| Malware scan | Optional scanner you configure | Only if you enable a scanner | No |