Data security
A part drawing says more about your business than your website does. So protecting files is not a paragraph in our terms, it is how the system is built. Below we show exactly which mechanism does what.
Example data
01File journey
Five stages in a file's life and the guard that covers each one. None of them is a setting to switch on: this is how the system behaves by default.
The file goes from the customer's browser straight to object storage over an encrypted connection. It never passes through our application server and never rests in the clear along the way.
Every uploaded file gets its own freshly generated AES-256 key, which encrypts that file and its 3D previews and nothing else. The file lands in storage already encrypted.
The file key is sealed with a master key that exists only on our application server. The storage provider does not hold it, so the storage disks alone are not enough to read anything.
The browser gets no link to storage, only a signed link to our API, valid for 15 minutes. In the panel it also works only within your signed-in session.
The file of a quote that never became an order is gone after 90 days, and an upload nobody completed after six hours. We delete the object itself, not just the row in the database.
The last stage is the easiest to overlook: data that no longer exists is the only kind nobody can take. That is why deletion here is a job the system runs by itself every hour, not a statement of intent.
02Encryption
The same order through three pairs of eyes. Switch to see what each of them can read.
You see everything: the file with its 3D preview and the customer's contact details.
Example data
STEP and IGES models, PDF and DXF drawings, scans and the generated 3D previews are encrypted in storage with AES-256, under a separate key for every uploaded file.
The storage provider holds no key. The storage disks alone are not enough to read a file.
Name, company, e-mail, phone, delivery address and notes are encrypted by the application before they reach the database. The database never sees the key.
In a copy of the database these fields are unreadable without the application's key.
We issue no links that download a file straight from storage. Every download goes through our API, against a short-lived signed token with its own scope and expiry.
A file token cannot be used as a session or the other way round. The scopes are separate and not interchangeable.
The panel, the widget, the hosted pages and the API are HTTPS only, with an HSTS header covering a year and every subdomain.
After the first visit the browser itself refuses an unencrypted connection.
The nightly database dump is encrypted with AES-256 on our server before it leaves it, and kept on a count-based rotation rather than a calendar one. A plaintext copy never touches the disk.
A separate command actually restores the newest copy and compares its row counts against production.
Passwords are hashed with Argon2. Sessions are signed tokens carrying a generation number: a password reset, signing out, and a new password an owner sets for an employee each invalidate every token issued earlier, instantly.
The session cookie is HttpOnly, Secure and SameSite, so no script on the page can read it.
03Boundaries
04Retention
Three clocks, each for a different situation. All of them run by themselves: the system checks them every hour.
The customer started uploading a file and never finished. The object is gone after six hours, without waiting out the full retention period.
deletedA quote or an order deleted by hand sits in Trash and can be restored together with its file. After that both are gone.
deletedThe file of a quote that never turned into an order is deleted from storage together with its previews. The quote itself remains: the numbers, not the geometry.
deletedFiles of quotes that became orders stay, because the shop needs them for production. You can delete an order and its quote through Trash - after 30 days they are gone for good - and deleting the account deletes them with it.
05Access
A short list, because a longer one would be the wrong answer.
Your shop's data
Customers' quotes and files
Shop configuration
You choose which tabs each employee sees.
They open it with an unguessable link, or its number plus the code from their e-mail.
Entering a shop's account and every file download go into a log.
The file store holds only ciphertext, and no key: 13b6 d4b0 408c ea83…
A shop account has an owner and employees. The owner decides which panel tabs each employee sees. Settings, including user management, are the owner's alone.
They see only their own quote and their own file - by an unguessable id, or by its number plus the access code from their e-mail, protected by a limit on attempts. There is no route from there to the shop's quote list or to any other customer's files.
Only named, authorised people: to handle a ticket, to diagnose a fault, and to check that the engine read a part and priced it correctly. That last purpose serves running and improving the platform only, and a confidentiality undertaking and the Terms forbid using what is learned there to manufacture parts or for anything competing with you. Signing in to the platform panel takes a password plus a one-time code by e-mail, the account locks after a run of failed attempts, entry into a shop's account lands in an event log, and every download of a customer's file is recorded before the first byte leaves.
The storage provider holds files only in encrypted form and has no key. Our other subcontractors, listed in the Privacy policy, receive no CAD files.
06Infrastructure and compliance
The whole infrastructure, meaning application, database, file storage and backups, runs in the European Union. Your files do not leave the EEA.
For your end customers' data you are the controller and we are the processor. The Article 28 GDPR processing agreement is part of the terms, so there is nothing to negotiate separately.
Sign-in and registration are protected by reCAPTCHA verification, and uploads by rate limits and a daily quote cap. Those are what limit the cost of somebody bulk-uploading junk.
We check PDF files, STEP files and photos of drawings not only by their extension but by their first bytes, and every file's analysis runs under a hard limit on time and memory. An archive, an office document or a program posing as such a file is refused before any parser touches it.
HSTS, a content security policy, MIME-type sniffing turned off and a restricted referrer policy on every domain. The platform panel is cut off from the public API.
The application runs in containers without administrator rights, on a read-only file system and without unnecessary kernel privileges.
07Questions
Including the ones whose honest answer does not flatter us.
Quoting is automatic and for the vast majority of files nobody on our team opens them. Named, authorised people do have access to them, though, and use it in three situations: when you report a problem with a quote, when the engine returns an error that needs diagnosing, and when we check that the engine read the part correctly and that its price holds against the one your engineer approved. That last one is where quoting accuracy comes from, yours and everybody else's. Those people are bound by a confidentiality undertaking, and the Terms forbid us to use your files to manufacture parts, to compete with you, or to broker machining work to anyone. Our team's accounts require a password plus a one-time code by e-mail, entry into your shop's account is recorded in an event log, and every download of your file by our team in an access log.
The quoting engine is a deterministic geometric and cost model, not a model trained on other people's parts. Calibration works only on your own quotes and never leaves your account. Your files reach no external service and no artificial-intelligence provider; reading text off scanned drawings runs locally on our server. We are working on a model of our own to read PDF drawings better. It would run on our infrastructure only, and a given shop's files could feed its development only with that shop's separate consent, withdrawable at any time. Until then nothing of the sort happens, and withholding consent will never affect the quality of your quotes.
The files would become unreadable, to us as well, because the storage provider holds no copy of the key. That is a deliberate trade: either the key is ours alone and no outsider can read anything, or somebody else holds it too and "no outsider" stops being true. Backup copies of the keys are kept off the server.
We do not, and we would rather say so plainly than hide behind a generality. Certification is an audit process we have not been through yet. This page describes mechanisms that genuinely run in the product, and we can evidence each of them on request under the processing agreement. If your procurement process needs a security questionnaire, we will fill it in.
No. A quote is reachable only by an unguessable id, or by its number plus an access code that a limit on attempts keeps anyone from guessing. On top of that, every query for a shop's data is filtered by that shop's account: taken from the session or the widget key, never from whatever the customer put in the address bar.
You take your data with you: quotes export from the panel to CSV, and the price list to JSON or CSV. When the account is deleted we delete its quotes, orders and files, from storage too. What remains are the records tax and accounting law requires us to keep; how long any other data is kept is set out in the Privacy policy.
The file itself is needed to price the part and to let an engineer check that the engine read it correctly. But you can move any quote to Trash as soon as you have dealt with it - its file is then gone after 30 days - and if you do not, retention does it for you. At your request we will delete files earlier, within 7 days at the latest.
Write to contact@metronq.com with a description and reproduction steps. We treat such reports first, we do not pursue people reporting in good faith, and we inform shops of a breach affecting their files without undue delay.
Write to us. The answer comes from the team that built this system, not from a support desk reading the terms. We are happy to fill in your security questionnaire too.
Or start the free trial