Security & confidentiality

Built so your clients' inventions stay your clients' inventions.

We handle pre-filing invention material every day. This page is an overview of what data we touch and how we protect it. A more detailed document is available upon request.

Security overview · June 2026Subject to change as the product evolvessupport@patentdrawingai.com

The life of one drawing.

What happens to a file between upload and export, step by step.

01

Upload, privately

Your image goes straight into private storage. No public link is ever created for it.

02

Ownership checked

Every request is signed in and checked against who owns the project before any work runs.

03

Generation

An enterprise cloud AI provider generates the drawing under enterprise terms. The request carries only what's needed to draw the figure. Your name, client, matter, and account never go with it.

04

Post-processing in-house

Cleanup and vectorization run on our own servers. After drawing, the AI is used only to number parts and check the figures, with zero data retention.

05

Signed retrieval

The finished drawing stays in private storage, served only through short-lived signed links, checked on every request.

How your data stays protected.

What we send the AI provider, who can reach your data, and how it's encrypted.

AI handling

Your files never train AI

Uploads, prompts, and drawings are not used to train any model.

Nothing kept by AI providers

Every AI request runs with zero data retention: the provider keeps nothing once the request is done.

Only what's needed is sent

Your image or text and our drawing instructions. No name, client, matter, account, or project goes with it.

Access

Signed-in requests only

Every request carries a signed token we check on our servers before anything runs.

Accounts stay separate

We isolate data in two places, the database and the application, so one account can't reach another's.

Encryption

In transit

All traffic uses TLS, from your browser to our servers and across our providers.

At rest

Your files and data are encrypted at rest, in both file storage and our database.

Download links

Files are served through signed links that expire.

Where your files live, and who can see them.

Each service that touches your files, and what it does with them. Ask us for the full subprocessor list.

What
Where it's kept
How it's protected
Uploads and drawings
Cloudflare R2 SOC 2Private storage
Encrypted at rest. Opened only through signed links that expire. Application text is deleted 30 days after your figures are drawn, or right away when you delete the project.
Account and matter records
Supabase SOC 2Private PostgreSQL database
Encrypted at rest. Visible only to your account: every request is checked against who owns the project.
AI processing
Enterprise AI providers ZDRZero-data-retention endpoints
Requests carry only what's needed to draw the figure, and the provider keeps nothing once the request is done. We never attach your name, client, or matter, and nothing is used for training.
Application servers
Render SOC 2Managed cloud hosting
Every connection is encrypted with TLS, from your browser to each provider.

Your data leaves when you say so.

Retention is short, and deletion is real.

Drawings and uploads
Kept while your account is active, plus 30 days. Deleted within 30 days of a request.
Account data (projects, prompts, ledger)
Kept while your account is active, plus 30 days. Deleted within 30 days of a request.

Deletion starts with one email to support@patentdrawingai.com, and runs end to end, including our subprocessors.

For your security team

Doing a formal review? Just ask.

We can share a fuller security overview and the full subprocessor list on request. Email us and tell us what your review needs.