Security

The company details are being added to this page.

How OpenMyDrawing protects your drawings and payments. Everything here describes how the service actually runs; we do not claim certifications we do not hold.

Your drawings

• Each uploaded file is opened in a separate, short-lived process with no network access, no access to payment keys or other data, its own throwaway user, and hard limits on time and memory. It ends after rendering.
• Files are not stored. Rendered pages stay in memory for at most an hour.
• Drawings are never used to train models or shared with anyone.

The service

• All traffic is encrypted (HTTPS with HSTS).
• The web service runs in a locked-down sandbox: no access to other software on the server, no access to the local network, and no permanent storage beyond the pass records and the visit counts (totals only, without IP addresses or visitor identifiers, as described in the privacy notice).
• Strict Content Security Policy, upload size limits and per-client rate limits.
• Software dependencies are pinned with checksums and monitored for known vulnerabilities.
• Pass records are backed up nightly.

Payments

Nothing is on sale at present. Once passes are, card payments are made on Stripe's own payment page; card details never reach our server.

Reporting a problem

If you find a security issue, please write to the address on the Company page. Our contact details for security reports are also published at /.well-known/security.txt.