Security
How SchematicForge protects your data: encryption at rest and in transit, retention controls, purge behaviour, deterministic drawings, and no training on your files.
Last updated: 2026-09-14
Encryption at rest and in transit
All traffic is served over HTTPS/TLS in transit. Uploaded files, generated workbooks, and drawing artifacts are stored encrypted at rest on our hosting provider's managed storage. Passwords are stored only as salted hashes; we never see or store plaintext passwords.
What we store
Account records: email address and a salted password hash. Project data: your uploaded IO lists, loop and signal records, and generated artifacts (workbook, DXF, SVG, PDF, ZIP). Anonymous preview uploads: the uploaded bytes and parse metadata, kept until claimed at signup; they are not auto-deleted.
Retention and purge
Anonymous preview uploads are kept until claimed at signup; they are not auto-deleted. Deleted projects are removed along with their generated artifacts. A full audit trail of purge events is recorded and can be provided for security reviews.
Audit log
We record key events — signup, login, project creation, imports, generation runs, exports, and deletions — with timestamps and account identifiers. Logs are retained internally and shared only in response to a security questionnaire or a lawful request.
Sub-processors
A complete, current list of sub-processors is published at /sub-processors. Today the list is the hosting provider that runs the application and stores artifacts, and Paddle for pack purchases.
On-premises option
The enterprise tier runs the same application as a Docker image on your own infrastructure, so no engineering data ever leaves your environment. Email schematicforge@gmail.com for details.
Security questionnaires
We answer security questionnaires and sign your NDA. Email schematicforge@gmail.com and reference this page; we reply the same day. A DPA is published at /dpa.
Plain-language commitments
No AI in the generation path
Loop diagrams, schedules, and registers are produced by a fully deterministic engine. Same input, same output, every time. Nothing in the generation path calls a model.
No training on your data
We do not use your projects, IO lists, or uploaded files to train any model.
No third-party AI in generation
Loop drawings never call a model.
Deleted on request
Projects can be deleted from the application and we remove the associated artifacts. Anonymous preview uploads are kept until claimed at signup; they are not auto-deleted.
NDA and DPA
We sign your NDA. A DPA is published at /dpa (PDF on that page). Security questionnaires: schematicforge@gmail.com, same-day reply. Regenerating Rev B/C inside a paid loop band is $0; growth past the band is the difference to the next band, not a second pack.