Security
A part drawing says more about your business than your website does. So protecting files is not a paragraph in our terms. It is how the system is built, and below we show which mechanism does what.
Step by step
Five stages in a file's life and the guard that covers each one. None of them is a setting to switch on. This is how the system behaves by default.
The file goes from the customer's browser straight to object storage over an encrypted connection. It never passes through our application server and never rests in the clear along the way.
TLS + HSTS
Every file gets its own freshly generated AES-256 key, used once, for that single object. The file lands in storage already encrypted, rather than encrypted a moment later.
A key per object
The master key that seals those per-file keys never leaves our server. The storage provider does not hold it. Physical access to the disks is not enough to read anything.
AES-256, key with us
Your browser never learns the file's address in the store. It gets a signed link to our own API, valid for 15 minutes, and in the panel additionally bound to your session. Copied to somebody else it opens nothing.
Link valid 15 minutes
The file of a quote that never became an order is gone after 90 days. An upload nobody completed is gone after six hours. We delete the object itself, not just the row in the database.
90 days and the file is gone
The last stage is the one that is easiest to forget: data that no longer exists is the only kind nobody can take. That is why deleting is a scheduled job here, not a statement of intent.
Specifics
STEP and IGES models, PDF and DXF drawings, scans and the generated 3D previews are encrypted in storage with AES-256, under a separate key for every object.
The infrastructure provider holds no key. It cannot read your file even with the disks in hand.
Name, company, e-mail, phone, delivery address and notes are encrypted by the application before they reach the database. The database never sees the key.
A stolen copy of the database tells nobody who ordered what from you.
We issue no links that point straight at the store. Every download goes through our API, against a one-time signed token with its own scope and expiry.
A file token cannot be replayed as a session or the other way round. The scopes are separate and not interchangeable.
The panel, the widget, the hosted pages and the API are HTTPS only, with an HSTS header covering a year and every subdomain.
The browser refuses an unencrypted connection before it even opens one.
The nightly database dump is encrypted inside the container, before it leaves the server, and kept on a count-based rotation rather than a calendar one.
A separate command actually restores the newest copy and compares its row counts against production.
Passwords are hashed with Argon2. Sessions are signed tokens carrying a session generation number. A password change instantly invalidates every token issued earlier.
The session cookie is HttpOnly, Secure and SameSite, so no script on the page can read it.
Boundaries
Retention
Three different clocks, each for a different situation. All of them run automatically.
6 hours
The customer started uploading and never finished. The object goes the same day, without waiting out the full retention window.
30 days
A quote or order deleted by hand sits in Trash and can be restored together with its file. After that both are gone.
90 days
The CAD file of a quote that never turned into an order is deleted from storage. The quote itself remains: the numbers, not the geometry.
Files of quotes that did become orders stay, because the shop needs them for production. You can always delete them earlier yourself, and deleting your account deletes them with it.
Access
A short list, because a longer one would be the wrong answer.
A shop account has an owner and employees. The owner decides which panel tabs each employee sees. Settings, including user management, are the owner's alone.
They see their own quote and their own file, reached by an unguessable id. There is no route from there to the shop's quote list or to any other customer's files.
Only named, authorised people: to handle a ticket, diagnose a fault, or check that the engine read a part and priced it correctly. That last purpose serves running and improving the platform only, and a confidentiality undertaking and the Terms forbid using what is learned there to manufacture parts or to do anything competing with you. Signing in to the platform panel takes a password plus a one-time code by e-mail, the account locks after a run of failed attempts, and entry into a shop's account lands in an event log.
The object storage provider and the server provider hold no encryption keys. Processors acting on our behalf are listed in the Privacy policy. None of them receives CAD files.
Infrastructure and compliance
The whole infrastructure, meaning application, database, file storage and backups, runs in the European Union. Your files do not leave the EEA.
For your end customers' data you are the controller and we are the processor. The Article 28 processing agreement is part of the terms, so there is nothing to negotiate separately.
Sign-in and registration are protected by reCAPTCHA verification, and uploads by rate limits and a daily quote cap. Those are what protect you from the cost of somebody bulk-uploading junk.
We check not only a file's extension but its first bytes. An archive, an office document or a program posing as a drawing is refused before any parser touches it.
HSTS, a content security policy, MIME-type sniffing turned off and a restricted referrer policy across every domain. The platform panel is cut off from the public API.
Every object records which key encrypted it, so replacing a key is a new key id and a background re-encryption.
Questions
Including the ones whose honest answer does not flatter us.
Quoting is fully automatic and for the vast majority of files nobody opens them at all. Named, authorised people on our team do have access, and use it in three situations: when you report a problem with a quote, when the engine returns an error that needs diagnosing, and when we check that the engine read the part correctly and that its price holds against the one your engineer approved. That last one is where quoting accuracy comes from, yours and everybody else's. Those people are under a confidentiality undertaking, and the Terms forbid us to use your files to manufacture parts, to compete with you, or to broker machining work to anyone. Our team's accounts require a password plus a one-time code by e-mail, and entry into your shop's account is recorded in an audit log.
The quoting engine is a deterministic geometric and cost model, not a model trained on other people's parts. Calibration works only on your own quotes and never leaves your account. Your files reach no external service and no artificial-intelligence provider; reading text off scanned drawings runs locally on our server. We are working on a model of our own to read PDF drawings better. It would run on our infrastructure only, and a given shop's files could feed its development only with that shop's separate consent, withdrawable at any time. Until then nothing of the sort happens, and withholding consent will never affect the quality of your quotes.
The files would become unreadable, to us as well, because the storage provider holds no copy of the key. That is a deliberate trade: either the key is ours alone and no outsider can read anything, or somebody else holds it too and „no outsider” stops being true. Keys are kept off the server.
We do not, and we would rather say so plainly than hide behind a generality. Certification is an audit process we have not been through. This page describes mechanisms that genuinely run in the product, and we can evidence each of them on request under the processing agreement. If your procurement process needs a security questionnaire, we will fill it in.
No. A quote is reachable only by an unguessable id, and every database query is filtered by the shop account: taken from the session or the widget key, never from whatever the customer put in the address bar.
You take your data with you. Quotes and orders export from the panel, and the price list stays yours. After the account is deleted we remove the files and personal data; what remains is only what tax and accounting law requires us to keep, as described in the Privacy policy.
The file itself is needed to price the part and to let an engineer check that the engine read it correctly. But you can delete any quote together with its file the moment you are done with it, and if you do not, retention does it for you. Shortening the retention window for a specific shop is something we can arrange; write to us.
Write to contact@metronq.com with a description and reproduction steps. We treat such reports first, we do not pursue people reporting in good faith, and we inform shops of a breach affecting their files without undue delay.
Write to us. The answer comes from the team that built this system, not from a support desk reading the terms. We are happy to fill in your security questionnaire too.
Or start the free trial