This statement reflects source checks and deployment verification. It is not a penetration-test report, certification, service-level agreement or approval for restricted customer data.
Project and inbox access
The engineering workspace requires sign-in. Protected workflows validate authentication and project ownership on the backend. Database access rules remain part of that boundary; a browser route guard alone does not protect data. Public fictional samples are separate static downloads.
Demo submissions enter a separate operator-only collection. Ordinary users and anonymous clients cannot list, view or directly create inbox records through the database API. The public submission endpoint returns a receipt, not the submitted contact information or other people's requests.
Request and browser safeguards
The API uses security headers, rate limiting and body-size limits. The demo endpoint adds a small JSON-body limit, permitted-origin checks, input limits, a signed expiring challenge, a hidden spam field and repeat-submission handling. It acknowledges only a confirmed stored request; a storage failure does not display success. Those measures reduce misuse and do not eliminate spam or every attack.
Public pages and the workspace are served over HTTPS. The service runs on a Hostinger virtual private server in the United States. An external check on October 26, 2026 found only web traffic (HTTPS, and HTTP for redirection) and administrative SSH reachable from the internet; the database and API listen only on internal ports. Server-side internal services use local endpoints and application processes are managed separately for staging and production. This is not a promise of application-level encryption at rest, end-to-end encryption or a customer-specific key-management arrangement.
AI and uploaded evidence
Use sanitized, authorized inputs for evaluation. Relevant project context may be transmitted to external AI services. Every OpenAI API request sets store: false, and no project files are placed in OpenAI file storage. OpenAI's published API terms state that API data is not used for training unless the customer opts in and that abuse-monitoring logs are kept for up to 30 days. SecurityDesignAI has not opted in: sharing of API inputs and outputs, model feedback, and evaluation or fine-tuning data with OpenAI is disabled for our OpenAI organization. There is no zero-data-retention arrangement, and AI processing is not restricted to a particular country.
Supported metadata removal in the dedicated site-photo normalization workflow is specific to that workflow. It does not establish that all files or visible photo content are free of sensitive information. Demo contact fields are not routed to an AI provider.
Backups and operations
The guarded deployment process verifies source identity, checks tests/builds, backs up affected code and data, checks service health and preserves rollback material. Recent release verification checked database integrity and healthy, separate staging/production processes. These checks do not certify every stored project or replace disaster-recovery testing.
Demo inbox records have a daily age-based purge after 90 days. The hosting provider takes a weekly server backup. Release/database backups and application diagnostics have separate retention and may outlive active-record deletion; there is no single guaranteed purge deadline for every copy. Encryption-at-rest, residency, incident-response timing, support access and customer-specific recovery requirements must be agreed and evidenced before sensitive onboarding.
Browser and exports
Authentication state and project caches can remain on a device. Downloaded deliverables are outside workspace access controls. Use trusted devices, protect accounts, clear shared-device site data and control access to exported files. Do not place credentials or restricted customer information in names, URLs, notes or screenshots.
Assurance and engineering responsibility
SecurityDesignAI makes no SOC 2, ISO 27001, FIPS, STIG, HIPAA, guaranteed uptime or data-residency certification claim. Manufacturer product references do not imply sponsorship or approval. An entity name, test count or successful deployment does not establish regulatory compliance or engineering accuracy on real projects.
Camera compatibility, firmware, server OS, entitlements, retention, usable storage, analytics capacity and final orderable SKUs require adequate evidence and qualified review. Public samples are fictional and preliminary; procurement and deployment remain subject to the applicable review and agreement.
Report an issue
Contact support@securitydesignai.com with a concise description and reproducible steps. Do not include passwords, tokens or sensitive customer data in an initial message. This statement does not promise a particular acknowledgement or breach-notification deadline; applicable duties and agreed terms remain relevant.
See the evaluation privacy notice before submitting contact or project information.