Security at SketchWeave

Trusted infrastructure

SketchWeave runs on established cloud platforms rather than servers we manage by hand. Our application and websites are hosted on Vercel, and our database, authentication, and file storage run on Supabase, which operates on top of major cloud infrastructure. This lets us inherit their physical security, network protections, and operational maturity, and focus our own effort on protecting your data inside the application.

Encryption

All traffic between your browser and SketchWeave is encrypted in transit using HTTPS (TLS). Your projects and uploaded drawings are stored on infrastructure that encrypts data at rest. We do not transmit your content over unencrypted connections.

Authentication and access

Accounts are secured through our authentication provider. Passwords are never stored in plain text, and sessions are managed with signed tokens. Access to a project is limited to you and the organization members you share it with, according to their role. We follow the principle of least privilege for our own systems as well.

Strict data isolation

Your data is walled off at the database layer, not just in the interface. We use row-level security so that each request can only reach the rows it is entitled to, and sensitive records such as third-party connection tokens are restricted to trusted server-side processes with no direct client access. Uploaded files are stored under per-organization and per-user paths so one customer's storage cannot be reached from another's.

Editing safely

A SketchWeave project is edited by one person at a time through an automatic single-edit lock. This prevents two people from overwriting each other's work and keeps the drawing set consistent. Changes are saved continuously, and version history is kept for drawings so you can see and recover earlier states.

Payments

Billing is handled by Stripe, a PCI Service Provider Level 1 certified payment processor. Your full card details are entered directly with Stripe and are never stored on our servers. We only retain limited billing records such as your plan and subscription status.

Integrations

When you connect a third-party service such as Autodesk Forma, we store only the tokens needed to sync on your behalf, held in restricted server-side storage. You can disconnect at any time, which removes those stored tokens so the connection can no longer be used.

Reliability and backups

Your data is backed up on a regular schedule by our infrastructure providers so it can be recovered in the event of a failure. Because software and services can still experience outages, we recommend keeping your own copies of critical drawings as part of your normal project record-keeping.

Reporting a vulnerability

We welcome reports from security researchers and customers. If you believe you have found a vulnerability or a security issue in SketchWeave, please email support@sketchweave.com with the details and steps to reproduce. Please give us a reasonable opportunity to investigate and address the issue before any public disclosure. We appreciate responsible reporting and will work with you in good faith.