Know how your workspace is protected.

Account access

Account passwords are stored as password hashes. Application sessions are validated by the backend and can be revoked. Provider sign-in uses server-side OAuth exchanges; provider access tokens are not kept as diagram content.

Linking a provider to an existing account requires signing in to that account first. A matching email address alone does not automatically merge accounts.

Files and sharing

The backend checks file ownership and team permissions. Public read-only links grant access to anyone who has the link until expiry or revocation, so treat the URL as a credential.

Trashing a file revokes its public links. Restoring the file does not reactivate those links. Downloaded images, PDFs, and project backups remain independent copies.

Operational safeguards

The production site uses HTTPS. API rate limits and request-size limits help reduce abuse. The service creates database backups and runs health checks; these controls do not provide a guarantee of uninterrupted service or recovery of every change.

Local draft recovery and version history are useful editing tools. Keep an exported project backup for important handoffs. drawarc.io does not currently claim SOC 2 certification or a contractual uptime SLA.

AI and sensitive content

When you request AI generation or edits, the prompt and relevant diagram context are sent to the configured AI provider. Do not place passwords, API keys, production credentials, or personal data in diagrams or prompts unless you have a clear basis to share them.

Architecture review findings describe evidence in a diagram. They are not a penetration test, infrastructure audit, or compliance certification.

Report a security issue

Email support@drawarc.io with a description, affected URL, and safe reproduction steps. Avoid including live credentials or other people’s private data. Please report suspected vulnerabilities privately rather than posting access tokens or private diagrams publicly.