Security.
Your drawings are engineering property. They are encrypted, isolated from other customers, held out of AI training, and deleted on your instruction. Below is the full account of how the platform protects them, and what your security team needs to clear Tagsight as a vendor.
- Privacy regulations
- PIPEDA · GDPR · CCPA
- Data processing agreement
- GDPR Article 28
- International transfers
- Standard Contractual Clauses
- Breach notification
- Within 72 hours
- Customer data in AI training
- Excluded
Controls.
Data protection
How your drawings are stored, isolated, and kept yours.
- Encrypted in transit and at rest, including database connections.
- Processed for extraction only, held out of any model training, fine-tuning, or improvement.
- Kept to your account, isolated from other customers.
- Exports carry your engineering data alone.
- Remove the original drawing at any time and keep the extracted list.
Access and authentication
Who can reach your account, and how that access is controlled.
- Passwords hashed, never stored in plaintext.
- Two-factor authentication via authenticator app.
- Repeated failed sign-in attempts progressively slowed, with an additional verification step when needed.
- Short-lived sessions with automatic rotation, invalidated on password change.
- Single sign-on (SAML) and SCIM provisioning on Enterprise plans.
- Organization-enforced two-factor authentication on Enterprise plans.
- IP allowlisting on Enterprise plans.
Privacy and your rights
Your control over your data, and the regulations we operate under.
- Compliant with PIPEDA, GDPR, and CCPA.
- Export all your data, or delete your account, from settings at any time.
- Data processed only for the purposes you authorize.
- Signed Data Processing Agreement under GDPR Article 28.
- Standard Contractual Clauses for international data transfers.
Monitoring and audit trail
A durable record of what happened, available to you.
- Tamper-evident history of every change to your account, drawings, billing, and security settings.
- The full history can be exported for your own audit.
- Extended audit-log retention on Enterprise plans.
- Structured logging with request correlation.
- Per-endpoint rate limiting across the API.
Reliability and infrastructure
Where the service runs, and how it stays available.
- Hosted on managed cloud infrastructure with automatic failover.
- HTTPS-only webhook delivery with network-level protections.
- Data residency options on Enterprise.
Vendors and data processing
The third parties involved, and the terms that bind them.
- Sub-processors are vetted, contractually bound, and limited to necessary functions.
- Listed by category below; the full list sits in the DPA under confidentiality terms.
- 30 days notice before a new sub-processor takes effect, with a right to object.
- Breach notification within 72 hours of confirmation.
- Data deleted or returned within 30 days of termination.
Where your file goes.
Every drawing follows the same path, from upload to deletion.
- Upload
- Your file is encrypted in transit and at rest. No other user, and no Tagsight employee, can access it without your explicit support request.
- Processing
- The file is read for extraction in an isolated environment. Sub-processors are listed in the DPA under signed confidentiality terms. Kept to your account, held out of AI model training.
- After extraction
- Files stay attached to your project. Review and export run against the same project record.
- On delete
- Delete a project and it moves to trash, then is permanently purged after the retention window along with its files, extraction results, annotations, and exports. You can remove the original drawing immediately at any point, keeping only the extracted data.
- Staff access
- Reached by Tagsight staff only when you request support.
Sub-processors.
The categories of third parties involved in delivering the service. The named list, under signed confidentiality terms, is in the DPA.
| Cloud hosting | Application hosting, database, and file storage. |
|---|---|
| Payment processor | Billing and subscriptions. Card data is handled directly by the processor; Tagsight receives only the billing status. |
| Email delivery | Transactional and notification email. |
| AI processing | Document analysis for extraction, contractually bound to use your content for extraction alone. |
| CDN and security | Content delivery, DDoS protection, and DNS. |
| Error monitoring | Application error detection and diagnostics. Processes limited technical data such as IP address and error context. |
| Product analytics | Aggregate product-usage analytics. Processes account-associated usage events. |
For your security review.
What a procurement or security team needs to clear Tagsight as a vendor, ready on request.
Available on request
- Signed Data Processing Agreement, GDPR Article 28
- Sub-processor list under confidentiality terms
- Completed CAIQ and SIG Lite security questionnaires
- Security posture documentation
- Standard Contractual Clauses for international transfers
- Microsoft AI Cloud Partner Program member
Organization controls
- Single sign-on, SAML, and SCIM provisioning
- Organization-enforced two-factor authentication
- IP allowlisting
- Extended, tamper-evident audit-log retention
- Data residency options
Common questions
How are uploaded drawings protected?
Files are encrypted in transit using TLS and at rest using industry-standard encryption. Database connections are encrypted. Drawings are processed in isolated environments and never shared across customer accounts.
Are drawings used to train AI models?
No. Drawings are processed for extraction only and never used to train, fine-tune, or improve any model. Proprietary content stays scoped to your account.
What happens when I delete a project?
Deleting a project moves it to trash so you can restore it if you delete by mistake. After the retention window it is permanently purged, including the original file, extracted data, annotations, and exports. You can also remove the original drawing at any time while keeping your extracted I/O list, and you can delete your account and all its data from settings. Retention windows are set out in the DPA.
Is Tagsight GDPR compliant?
Yes. Tagsight complies with PIPEDA (Canada), GDPR (Europe), and CCPA (California). You can export all your data or delete your account at any time through account settings. A signed Data Processing Agreement is available at /dpa.
Where is data stored?
On managed cloud infrastructure with automatic failover and rate limiting on all endpoints. Sub-processors are listed in the DPA under signed confidentiality terms. Enterprise terms cover specific data residency requirements.
How is authentication secured?
Passwords are hashed with industry-standard algorithms and never stored in plaintext. Sessions are short-lived with automatic rotation. Repeated failed sign-in attempts are progressively slowed and can require an additional verification step, and two-factor codes lock out after repeated failures. Sessions invalidate on password change. Two-factor authentication via authenticator app is available.
Can Tagsight complete our security questionnaire?
Yes. Tagsight maintains completed industry-standard security questionnaires, including CAIQ and SIG Lite, along with security posture documentation. Most procurement teams accept these for vendor security review, alongside the signed DPA. Email support@tagsight.io to request the security package.
What enterprise security controls are available?
Single sign-on (SAML), SCIM user provisioning, IP allowlisting, organization-wide enforced two-factor authentication, and extended audit-log retention are available on Enterprise plans. Data residency options are available on Enterprise. A signed DPA and Standard Contractual Clauses for international transfers apply to every customer.
Working under NDA.
Drawings are processed in isolated environments, kept to each account, and held out of AI training. If your project requires a data processing agreement or a non-disclosure agreement, the signed templates are ready on request.