Security
Draft — last updated 22 July 2026.
Draft — this text is under review and does not yet form a binding legal document.
Hosting
Asads runs entirely on managed cloud infrastructure: the application is hosted on Vercel, data lives in a managed Postgres database (Neon), and files are stored in Cloudflare object storage. There is no self-hosted hardware, and all traffic between your browser and the service is encrypted with TLS.
Tenant isolation
Each customer organisation is a separate tenant. Isolation is enforced in layers: your sign-in is scoped to your organisation, every database query is scoped again by the application, and the database itself enforces row-level security so one tenant’s rows can never be returned to another. Tenant data is never mixed in shared documents or caches.
Data protection
Data is encrypted in transit and at rest. Uploaded drawing files are analysed and then permanently deleted within about two hours of upload — the platform keeps the structured results, not your originals. Deleted projects have a 30-day restore window before permanent removal, and you can request an export of your data or close your account from Settings at any time.
Access control
Access on our side follows least privilege: sensitive administrative actions require multi-factor re-verification and are recorded in an access log. Rate limiting and automated usage safeguards protect the service against abuse.
Reporting a concern
If you believe you have found a vulnerability or weakness in Asads, please report it through the contact form with enough detail for us to reproduce it. We will acknowledge your report and investigate promptly. Please do not test against data that is not your own.