Security
Last updated: 23 October 2026
Atlassia is built so that the most sensitive thing you have, your CAD file, never reaches us. This page explains what we do hold, where it is, and how it is protected.
Your CAD file stays on your computer
STEP, IGES and BREP files are read in your browser with OpenCASCADE compiled to WebAssembly, and STL, 3MF and OBJ files (loose or zipped) are read there too. The file itself is never uploaded, not when you import it, save a project or publish a catalog. The exception is a file you ask Claude to send to Atlassia: it waits in a private inbox in your account until you open it, and is deleted then or after 24 hours at the latest. What Atlassia stores are the 3D display models generated from it, your parts list and the files you attach.
You also decide, part by part, what a published catalog shows: the real shape, a plain bounding box, or nothing. Hidden parts are never uploaded at all.
What we store, and where
| Data | Stored in | Who can read it |
|---|---|---|
| Saved projects: parts list, links, settings, display models, attachments | Supabase database and private file storage, EU (Ireland) | Only your account |
| Published catalogs | Supabase private file storage, EU (Ireland) | People you give the link (and passcode, if set) |
| Quote requests from your catalogs | Supabase database, EU (Ireland) | Only your account, always through our server |
| Catalog statistics | Supabase database, EU (Ireland) | Only your account; daily totals with no visitor identifiers |
The app and catalog pages are served by Vercel. Our full list of service providers is in the data processing agreement.
How access is protected
- Sign-in uses a one-time link sent to your email address; there is no password to leak or reuse.
- Every project belongs to one account. Row-level security in the database lets an account read and change only its own projects and files.
- Published files are private. Each request goes through our catalog service, which checks that the catalog is live, not revoked, and unlocked if it has a passcode, then issues a link to the file that expires after 30 minutes.
- Passcodes are never stored in readable form, only as salted scrypt hashes. Changing a passcode immediately invalidates every earlier unlock.
- Connected AI assistants cannot change your data. An assistant you connect can read your projects, catalogs and requests, and can send files to a private import inbox that only you can open. It cannot change, publish or delete anything, and you can revoke it at any time.
In transit and in use
- All traffic uses HTTPS, with HSTS so browsers never fall back to plain HTTP.
- Security headers are sent on every page. An enforced content security policy lets the app load code and data only from Atlassia and its own storage, and the editor cannot be framed by other sites.
- Quote notifications to webhooks go only to public HTTPS addresses, never through redirects.
- Rate limits protect quote requests, passcode attempts, the contact form and publishing. For this, an IP address is kept only as a one-way hash, for at most one hour.
Your data, your control
- Export: download any project with its parts list (CSV), 3D models, attachments and project data.
- Hide, revoke or delete any catalog. Revoking removes its published files; the link stops working for good.
- Delete your account yourself. It removes your projects, catalogs, quote requests and settings in one step.
- We do not use your content to train AI models, for advertising or for anything other than running Atlassia for you (Terms, section 4).
Report a vulnerability
If you believe you have found a security problem in Atlassia, please tell us before telling anyone else. Use the contact form and choose Problem, or email contact@atlassia.de. We aim to acknowledge reports within three working days.
Please only test against your own account and data, do not access or change other people's data, and avoid anything that degrades the service for others. We will not take legal action against research done in good faith within these limits. Our contact details are also in security.txt.