Security and data
Your designs stay yours. Here is how Resin protects them.
Resin is a small team, so this page is short and plain. It lists every provider that touches your data, what is in place in the product today, and what is not yet: no SOC 2, no ISO 27001, no independent penetration test.
Found a vulnerability? Email hello@resineda.com. Do not attach confidential project files.
01
Audits and certifications
Where we are on the audit roadmap. Reports will be published here when they exist.
| Topic | Detail | Status |
|---|---|---|
| SOC 2 Type I and II | Not started. We answer security questionnaires in the meantime, with "not in place" stated plainly where that is the case. | Not yet |
| ISO 27001 | Not started. | Not yet |
| Penetration test | No independent test yet. We do not run a bug bounty; see vulnerability disclosure below. | Not yet |
| HIPAA | Resin is not a HIPAA-eligible service and this is not on the roadmap. | Not offered |
02
Product controls
What protects an account and a workspace today.
| Topic | Detail | Status |
|---|---|---|
| Password sign-in | Passwords are stored as bcrypt hashes. Sign-in is throttled to five attempts per five minutes, and every attempt is logged. Privacy Policy | In place |
| Two-factor authentication | TOTP with any authenticator app, for every account. The secret is stored encrypted and the eight backup codes are hashed. Support | In place |
| Sessions | Six-hour access tokens with a refresh token in an HttpOnly, Secure, SameSite cookie, expiring after seven days or thirty if you stay signed in. | In place |
| SAML SSO and SCIM | Sign in with Google works today. SAML single sign-on, SCIM provisioning, and organization-enforced 2FA are not offered. | Not offered |
| Workspace roles | Admin, Lead, Designer, and Viewer. Viewers read, comment, and export; paid roles edit; Admins manage members and billing. Privacy Policy | In place |
| Encryption | TLS for all traffic. Two-factor secrets are encrypted in the application; database disk encryption is Railway's managed volume, confirmed in writing on request. | In place |
| Export and deletion | Export any project in full at any time (KiCad, Altium, Gerber, ODB++, STEP, BOM). Delete your account or organization from Settings without asking us. Privacy Policy | In place |
| Application safeguards | Validated CORS allow-list, CSRF protection, per-endpoint rate limits, and a request ID on every call. The test suite runs inside the production image build; a failing suite cannot ship. | In place |
| Vulnerability disclosure | Email hello@resineda.com with steps to reproduce. We acknowledge every report, keep you informed while we fix it, and credit you if you want. Security contact | In place |
| Incident response and backups | Backup retention, restore testing, notification windows, and an uptime SLA are not published. Enterprise agreements can include written commitments. | Not yet |
| Organization-level AI controls | No switch to disable AI features or limit what they read. Every AI action is an ordinary edit you can reject or undo, metered in Usage & billing. Privacy Policy | Not offered |
03
Sub-processors
Every third party that processes customer data, what it receives, and where. If a provider is not listed, it does not receive customer data. No third-party analytics or advertising scripts run on the site or in the app.
| Provider | Purpose | Data it receives | Region |
|---|---|---|---|
| Railway | Hosting: application, API, PostgreSQL, and git-backed project storage | All account and project data | United States |
| Anthropic | AI models (default provider) | Chat messages and the project context needed to answer | Managed by Anthropic; API inputs are not used for training |
| OpenAI | AI models | Chat messages and the project context needed to answer | Managed by OpenAI; API inputs are not used for training |
| Stripe | Subscription billing and invoices | Name, email, billing address, tokenized payment method | Managed by Stripe (PCI-DSS Level 1) |
| Resend | Transactional email | Email address and the message sent to you | Managed by Resend |
Sign in with Google | Email and profile from your Google account, only if you use it | Managed by Google | |
| DigiKey | Part search and lifecycle data | Part search queries | Managed by DigiKey |
Security contact
Ask for what your review still needs.
Send your questions and the scope being evaluated. We answer every one, including with “not in place” where that is true. Customers with a contract can request a completed questionnaire.