Security at Design IQ. How we store, process and protect your engineering data.

Design IQ is a web application. Documents you upload are stored in encrypted cloud object storage, scoped to your organization. Project folders, workflows, review results, and metadata are stored in our application database — every record is tied to an organizationId and only accessible to members of that organization.

API routes authenticate via Clerk and re-resolve your active organization before reading or writing data. Cross-tenant access is blocked at the application layer; there is no shared document pool across customers.

Deleting a document or project removes it from your workspace. Enterprise customers can arrange custom data retention terms.

All traffic between your browser and Design IQ uses HTTPS. When you upload a file, your browser receives a short-lived presigned URL and sends the file directly to our object storage — the upload does not pass through a third-party file host.

When you run a review or chat, document content and checklist context are sent to the Design IQ backend, which forwards processing to our AI pipeline. Results are written back to your organization's workspace. No AI API keys are stored in the browser.

We record how Design IQ is used ourselves, in our own application database: product events such as signing up, uploading a document, starting a review or sending a chat message, and, when you are signed in, the pages you open, the buttons and links you click (by their label), and how long you are active. Events are stored against your user and organization ids; they never contain what you type, the content of your documents, or your findings. Click and activity records are deleted after 90 days. We use this to understand and improve the product, and it is never sold or shared.

We don't use third-party product analytics or session recording. Our host, Vercel, counts anonymous page views without cookies.

When you first arrive from another site or a tagged link, we set one first-party cookie, diq_ft, for 30 days. It holds where you came from (the campaign tags in the link and the referring site's domain, never the full address), the page you landed on, and when. If you sign up, it is saved with your organization so we know which channels bring people to Design IQ.

Google's Service Specific Terms for the Gemini Enterprise Agent Platform commit to not using customer data to train or fine-tune AI/ML models without prior permission. This applies to Google's own Gemini models and to partner models served through the platform (Anthropic Claude, Meta Llama, Mistral). Your prompts and responses are not shared with the model publishers.

By default, Google's Gemini models cache inputs and outputs in-memory only (not at rest), isolated per Google Cloud project, with a 24-hour TTL. Caching can be disabled at the project level for customers requiring formal zero-data-retention posture.

Sign-in is managed by Clerk. The web app uses standard session-based authentication — you sign in through your browser and access your organization's workspace from any device.

No AI API keys live in the browser. All AI traffic flows through the Design IQ backend, which holds service credentials server-side and never exposes them to the client.

Contact us for the current list of sub-processors.

The Design IQ web app is served over HTTPS from managed cloud infrastructure. Object storage and the application database are hosted by providers that hold SOC 2 Type II reports, with encryption at rest and in transit.

AI processing runs server-side on managed cloud infrastructure. Server-side credentials are stored as environment secrets and are not accessible from the browser.

Email security reports to lex@designiq.app with “Security” in the subject line. Acknowledgment within 1 business day. Design IQ will not pursue legal action against researchers who report vulnerabilities in good faith and follow coordinated disclosure.

For IT and security teams evaluating a deployment, we maintain a detailed reference covering architecture, network endpoints, sub-processor contracts, vulnerability management, and incident response. Email lex@designiq.app or book a review call to request it.