Security and data handling
How Deburr stores, protects and deletes your drawings and first article inspection data.
What Deburr is
A browser-based app for AS9102 first article inspection: ballooning drawings, recording measurements, and producing signed reports. Nothing to install.
Where data lives
Database and private file storage hosted by Supabase; the hosting region is configurable per deployment (ask us which). The API runs on Render.
Encryption
In transit: HTTPS (TLS) everywhere.
At rest: database, files and backups encrypted by the hosting provider.
Access control
Roles: owner, admin, approver, inspector, viewer, checked by the API on every request. Data is scoped per organization. Files are reachable only through short-lived signed links.
AI providers
Drawings and copilot messages are sent to an AI model provider to process. We use API terms where providers don't train on your data. AI never signs, approves or deletes; a person does.
Audit trail and e-signatures
Append-only, hash-chained event log of every reading, edit and signature. Signing requires re-authentication and records name, meaning, time, IP and a SHA-256 hash of the signed content.
Export-controlled data
ITAR / CUI work: available as an add-on at added cost, in a separate, access-controlled workspace. The standard workspace blocks and deletes uploads marked ITAR, EAR99, export controlled, CUI or USML. The scan only catches marked drawings, so keep controlled data out of it.
Deletion
Files deleted on request. The org owner can delete the whole organization, its records and files, in one click. Backup copies expire on the provider's schedule.
Service providers
- Supabase: database, sign-in, file storage
- Render: API hosting
- AI model provider: drawing reading, copilot
- Dodo Payments: billing (merchant of record)
- Resend: transactional email
Certifications
SOC 2: on the roadmap, not yet. No ISO 27001 certificate. We'll complete your security questionnaire and join a call with your IT team.