Security and your files
Lineplate is built so your CAD model stays on your machine. This page explains, in plain terms, what that means, where things are kept, and what we haven't done yet.
Where your file goes
When you import a file, your browser reads it and hands it to the geometry kernel, which runs in a background worker in the same browser tab. The kernel is Open CASCADE Technology compiled to WebAssembly. Nothing is uploaded: the studio has no upload route on our server.
That is our kernel. If you point the studio at a kernel of your own in its kernel settings, that kernel's code is handed your file in the same way, so use one you built yourself or trust.
Everything after import also happens in your browser: the 3D view, hidden-line clean-up, the SVG, the PDF (written by PDFKit in a background worker) and the PNG.
What is stored where
All of it is in your browser's own storage for this site. None of it is sent to us.
| What | Where |
|---|---|
| Project record: name, view, camera, line style, page settings, list of kept drawings | IndexedDB |
| Explode edits, the parts list, balloons and labels, title-block fields, the step sequence, the manual, your saved manual templates and the project's brand template (with their logo) | IndexedDB, in the project record |
| Import result: the assembly structure and shape properties | IndexedDB |
| Earlier revisions: each one's project state and import result | IndexedDB, deleted with the project |
| Meshes for the 3D view | Origin private file system (OPFS) |
| The CAD file itself, only if you tick “Keep a copy” | OPFS |
| The kernel's import cache: the model's exact geometry, as the kernel read it, so reopening a project doesn't read the file again | OPFS, deleted with the last project of that file |
| For large drawings: simplified meshes of the parts and which shapes are heavy | OPFS, deleted with the last project of that file |
| Hidden-line results (the 2D edges of each drawing), the explode plan, step and manual pictures, and project thumbnails | OPFS, deleted with the project |
| Your saved line-style presets, your default brand template (company, drawn by, logo, colour, font), and settings: theme, panel layout, whether to keep a copy of the file, a custom kernel address | localStorage |
| Exported SVG, PDF and PNG | Made in your browser and saved wherever your browser saves downloads |
What our server holds, if you have an account
Pro and Team need an account. The account lives in our database; your projects still don't. This is everything in it, and nothing of your CAD model, your projects, your drawings or your part names is among it.
| What | Where |
|---|---|
| Your email address, sign-up and last sign-in dates, the business declaration and the terms version accepted | Our database |
| Your company's name, country and VAT number (and when VIES confirmed it) | Our database |
| Workspace members and their roles; invitations (email, role, dates) | Our database |
| The subscription: plan, seats, status, billing period, latest invoice paid or not | Our database, copied from Stripe |
| A log of account events (sign-ins, invitations, subscription changes, exports, deletions) | Our database |
| The sign-in link token, until it is used or has expired | Our database |
| Card details, invoices and payments | Stripe, never our database |
| Your sign-in | Cookies in your browser: the session, for up to 14 days, and two for the sign-in form that end when you close the browser |
In the database, each company's rows are kept apart by row-level security in PostgreSQL itself, not only by our code: the connection the app uses can only see the workspaces the signed-in person belongs to. Card details never reach us; Stripe takes them directly.
What your browser does fetch from us
Only the parts of the app itself. Nothing of your files or projects goes the other way:
- the pages, scripts and styles of the site, and its fonts (Inter and JetBrains Mono), which are served from this site rather than from Google;
- when you make your first PDF, the fonts and colour profiles it embeds (the 8.6 MB print profile only for a CMYK PDF);
- the geometry kernel, as two separate files (about 15 MB, kept by your browser's cache after the first visit), or from the address you gave, if you set your own kernel in the studio's kernel settings.
There are no analytics, advertising or other third-party scripts on any page.
Forms are the exception: they send what you type into them to our server. The sign-in, account and checkout pages send your email address, your company's details and invitations, which is the account data listed above. The quote request form, open to anyone, sends whatever you write in it, and reaches us by email. None of it is anything of your projects.
Encryption
Your files and projects are never transmitted, so there is nothing of them to encrypt in transit. What the studio keeps in browser storage is not encrypted by us: it is protected the way your other local files are, by your operating-system account and your browser profile. If several people share one browser profile, they share these projects.
Deleting your data
- Deleting a project in the studio removes its record, its import result, its drawings, its explode plan, its earlier revisions and its step and manual pictures, and its meshes, import cache and kept copy of the file unless another project of the same file still uses them.
- Clearing this site's data in your browser settings removes everything above, including saved presets.
- We hold no copy of your projects, so there is nothing of them for us to delete and nothing we could recover for you.
- An account is deleted from its account page; billing records are kept without your name or email, as tax law requires.
The open-source kernel
The geometry kernel is Open CASCADE Technology 8.0.1, licensed under the LGPL 2.1 with the Open CASCADE exception. It is kept as a separate, replaceable component with no product logic in it, and talks to the rest of the studio through a versioned message format. You can run the studio on a kernel you built yourself from its kernel settings. Open-source notices has the licence, how to get the source, and how to replace it.
Browser protections
- Every page sends a Content Security Policy. Scripts run only from this site, and only with a one-off code issued for that page, so text that ends up in a page, such as a part name from a CAD file or a caption, can't run as code. WebAssembly is allowed, because the kernel is WebAssembly.
- Pages may connect only to this site. The kernel's background workers may also load a kernel you chose yourself in the kernel settings, which can be on another server; nothing else does.
- Forms post only to this site, or to Stripe's checkout and billing pages when you buy or manage a subscription.
- Inline styles are allowed, because the drawings and the interface use style attributes. Styles can't run code.
- No other site may show these pages in a frame.
- Browsers are told to use HTTPS only, not to guess file types, and to send other sites no more than our domain as the referrer. Camera, microphone, location and similar browser features are switched off.
Sub-processors
No third party receives your CAD files or anything derived from them. For account holders, Stripe handles payments and Microsoft Azure Communication Services sends sign-in and invitation emails; they receive the account details above that their job needs, nothing of your projects. The website itself has to be served by a host, which sees ordinary request data such as IP addresses and the pages requested, as any website host does. The site is hosted by Microsoft Azure (UK South), behind Cloudflare.
There is no cloud workspace: projects aren't shared or synced through us, on any plan. If that ever changes, this list will be updated before it is switched on, and working only in your browser will remain the default.
What we haven't done
- We hold no security certifications: not Cyber Essentials, ISO 27001 or SOC 2.
- No independent penetration test has been carried out.
We would rather say so than let you assume otherwise.
Developer builds
Reporting a security issue
Email hello@lineplate.com with what you found, how to reproduce it, and how to reach you. Please give us a reasonable chance to fix it before you publish anything.
Lineplate is made by Galaxy Technology (ICO registration ZC212441). See also the privacy notice.