# Security at Design IQ

> How we store, process and protect your engineering data.

## Data storage & access

Design IQ is a web application. Documents you upload are stored in encrypted cloud object storage, scoped to your organization. Project folders, workflows, review results, and metadata are stored in our application database — every record is tied to an `organizationId` and only accessible to members of that organization.

API routes authenticate via Clerk and re-resolve your active organization before reading or writing data. Cross-tenant access is blocked at the application layer; there is no shared document pool across customers.

Deleting a document or project removes it from your workspace. Enterprise customers can arrange custom data retention terms.

## What leaves your browser

All traffic between your browser and Design IQ uses HTTPS. When you upload a file, your browser receives a short-lived presigned URL and sends the file directly to our object storage — the upload does not pass through a third-party file host.

When you run a review or chat, document content and checklist context are sent to the Design IQ backend, which forwards processing to our AI pipeline. Results are written back to your organization's workspace. No AI API keys are stored in the browser.

## AI model training

Google's Service Specific Terms for the Gemini Enterprise Agent Platform commit to not using customer data to train or fine-tune AI/ML models without prior permission. This applies to Google's own Gemini models and to partner models served through the platform (Anthropic Claude, Meta Llama, Mistral). Your prompts and responses are not shared with the model publishers.

By default, Google's Gemini models cache inputs and outputs in-memory only (not at rest), isolated per Google Cloud project, with a 24-hour TTL. Caching can be disabled at the project level for customers requiring formal zero-data-retention posture.

## Authentication

Sign-in is managed by Clerk. The web app uses standard session-based authentication — you sign in through your browser and access your organization's workspace from any device.

No AI API keys live in the browser. All AI traffic flows through the Design IQ backend, which holds service credentials server-side and never exposes them to the client.

## Infrastructure & hosting

The Design IQ web app is served over HTTPS from managed cloud infrastructure. Object storage and the application database are hosted by providers that hold SOC 2 Type II reports, with encryption at rest and in transit.

AI processing runs server-side on managed cloud infrastructure. Server-side credentials are stored as environment secrets and are not accessible from the browser.

## Vulnerability disclosures

Email security reports to lex@designiq.app with "Security" in the subject line. Acknowledgment within 1 business day. Design IQ will not pursue legal action against researchers who report vulnerabilities in good faith and follow coordinated disclosure.

## Sub-processors and the full security review

Email lex@designiq.app for the current list of sub-processors, or to request the detailed security review document (architecture, network endpoints, sub-processor contracts, vulnerability management, incident response).