Your data stays your data.
We don't use customer datasets to train shared models. Each workspace is isolated, and production deployments use encrypted transport and access controls by default.
/demo route uses sessionStorage only — annotations are cleared when you close the tab and are never visible to the next visitor on a shared device. Demo images never leave your browser. In a verified workspace, every upload is authorized per file with a short-lived signed PUT URL; on S3-compatible object storage the image bytes go from your browser straight to the bucket, and on managed local storage the same authenticated, checksum-verified channel runs through our servers.Security built into the product, not bolted on.
Encrypted in transit
All public traffic is served over HTTPS with HSTS (2-year max-age, preload) and a strict Content-Security-Policy that upgrades insecure requests. Security headers are enforced on every response.
Workspace isolation
Every API query is scoped to your organization through role-based permission checks. Enterprise tenants can request dedicated storage isolation.
RBAC built in
Ten org roles with typed, non-hardcoded permissions. Annotator, Reviewer, ML Engineer, and Owner roles out of the box.
No shared training by default
Customer datasets are not used to train shared models. Contribution mode is opt-in and contract-bound.
Signed URLs for files
Every upload is authorized per file with a short-lived signed PUT URL (default 900-second TTL). On S3-compatible object storage the bytes go from the browser straight to the bucket; on managed local storage the same authenticated, checksum-verified channel runs through our servers.
Audit logs
Every sensitive change — signup policy, financial policy, offer / promo / credit transitions, gift-card issue, access-request decisions — writes an append-only audit row with actor, reason, before/after, and a request ID. Cross-cutting timeline at /admin/audit.
Compute isolation
Training never runs on the web tier — GPU training workers are external by design. Annotation AI runs in your browser by default; optional server-assisted refinement runs in a separate worker process with strict payload caps, not in the web server.
Single sign-on (SAML / OIDC)
SSO is on the enterprise roadmap and is not shipped yet. If your security review requires it, tell us in an enterprise conversation and we'll share timelines.
Need a security questionnaire?
For enterprise pilots, security reviews, on-prem deployments, or compliance requirements, note “enterprise” in your request and our team will route it appropriately.