Your CAD is your intellectual property. We treat it that way.
Customers retain ownership of their CAD files, designs and engineering data. This page lists the controls built into the Cadxor platform today and the ones on our roadmap — clearly separated.
Certifications. Cadxor does not currently hold SOC 2, ISO 27001 or any other security certification. We are building toward SOC 2 readiness and will say so here only once an audit is complete.
Controls in the current codebase
Tenant isolation
Every customer-owned record carries an organisation ID, and every query is scoped to the authenticated organisation. Cross-tenant access is covered by automated tests.
Role-based access
Permission-based authorisation under editable roles (owner, administrator, engineer, approver, sales, estimator, manufacturing, viewer, customer, distributor).
Credential handling
Passwords hashed with scrypt. API keys, session tokens, worker tokens and customer approval links stored only as SHA-256 hashes and shown once.
Session security
HttpOnly session cookies, SameSite protection and CSRF tokens on every state-changing request; login rate limiting.
Signed, expiring downloads
Files are only served through HMAC-signed links that expire after minutes. Every download is written to the audit log.
Tamper-evident audit log
Configuration, approval, generation, download, integration and administrative events are hash-chained per organisation, so edits or deletions are detectable.
Upload validation
Extension allow-list, size limits and content checks (e.g. STEP header) on every upload. Released component revisions are immutable.
Isolated CAD workers
Workers run fixed, versioned engine code against structured job data. No user-supplied code is executed; workers are outbound-only and never exposed to browsers.
Secure defaults
Strict Content Security Policy, frame denial, no-sniff and referrer headers; the platform refuses to start in production with development secrets or demo data.
Infrastructure controls
- TLS 1.2+ for all traffic; HSTS on all Cadxor domains
- Encryption at rest for the database and object storage, with object versioning
- Secrets in a managed secrets store; ERP credentials referenced, never stored in the app database
- Automated database backups with point-in-time recovery; tested restores
- Malware scanning of uploaded files before they are made available
- Centralised logging, monitoring and alerting; error reporting without customer CAD content
- SSO/SAML and enforced MFA for Enterprise plans
- Least-privilege employee access with audited, time-bound support access
Your data, your rights
- You own your CAD, drawings, rules and engineering data.
- We use it only to provide the service to you.
- We do not use customer CAD or engineering data to train AI models.
- You can export your data, and we delete it on termination per the agreement.
These commitments are reflected in our draft Terms and Data Processing Addendum, which are pending legal review.
Report a vulnerability
Email security@cadxor.com. Please give us reasonable time to fix an issue before disclosure.
Need a security review?
We will walk your IT team through the architecture, data flows and controls, and answer your questionnaire honestly.