Security Overview

1. Overview

Pitchlume is built for manufacturers whose drawings, CAD files and rating tables are their most valuable information. We are a young company, and we would rather tell you exactly what we do today than promise what we have not built. This page explains how we protect your data, which technology we use, and where we are on the road to formal audits. It describes the product as built on the version date of this document. It is a description, not a warranty; our commitments are in the Terms of Service and the Data Processing Addendum.

Pitchlume is made by EraShift Studio LLC, a Texas company, and is hosted in the United States.

Our principles

• Your data stays in your workspace. No data and no setting crosses from one customer's workspace to another.
• Your data stays in the US. Hosting, database, file storage and AI processing of your files run in US regions. The one stated exception is an optional marketing-video feature (see the Subprocessor List).
• We never train AI models on your content, and we only use AI providers whose paid commercial terms say they do not either.
• A person in your company decides what is published. Nothing uploaded or generated by AI goes live without a person confirming it.
• Your sealed drawing stays the document of record. We store your original files unchanged and label everything we generate as a representation.
• We tell you what we do not have. We do not hold SOC 2, ISO 27001 or any other certification today. See "What we do not claim" below.

2. Infrastructure and hosting

Our production infrastructure runs in US regions. We do not add a provider or region that stores Customer Data outside the US without first updating our subprocessor list and giving notice. Full list: Subprocessor List.

3. Workspace isolation

Each customer has its own Workspace. Isolation is enforced in the database itself, not only in the user interface.

• Deny by default. Every table that holds workspace data has Postgres row-level security turned on, with policies that let a signed-in person read only rows of the workspace they are working in. A table without a policy returns nothing.
• One workspace per session. A person who belongs to several workspaces works in one at a time. Switching workspace never shows the previous workspace's data or settings.
• Settings are isolated too. Viewer defaults, presets, prompts, AI memory, caches, background jobs and file storage paths all carry the workspace.
• Tested on every change to access rules. An automated test suite checks that one workspace cannot read or change another's rows, for every workspace table, and runs whenever the schema or access rules change.
• Our own staff. EraShift administrators cannot enter a customer workspace from the app unless the customer has made them a member. Platform administration uses a separate, server-only account; every change it makes to a workspace is recorded with the target workspace. A small number of EraShift engineers can reach the production database and storage to operate the service; they do so only when needed to run, secure or support it.
• Calculation IP stays on the server. Your rating tables and formulas are never sent to the browser. The server answers one question at a time (for example, the rating for one size).

4. Encryption

In transit

• All traffic uses TLS (HTTPS). Browsers are told to use HTTPS only (HSTS, two years, including subdomains).
• Server-to-database connections outside the app require TLS. Internal job and worker calls refuse to send their credentials over plain HTTP.

At rest

• The database and file storage are encrypted at rest with AES-256 by our infrastructure provider.
• Application-layer encryption with a per-workspace key. On top of that, your most sensitive files are encrypted by Pitchlume itself before they are stored, with a data key that belongs to your workspace only: drawings and sealed PDFs; CAD and 3D source files; 3D and CAD exports; account files (RFQs, case and customer documents); meeting recordings and transcript files; and catalog uploads.
• How it works: each workspace has its own 256-bit data key. Files are encrypted with AES-256-GCM in authenticated chunks, so tampering, truncation or moving a file to another place is detected. Workspace data keys are themselves encrypted ("wrapped") with a master key that is held outside the database. A copy of the database alone cannot decrypt any file.
• Who holds the keys: EraShift holds the master key. Keys and file contents are never logged or sent to the browser. We can rotate a workspace's data key and the master key.

What this is not

• It is not end-to-end encryption. Our servers decrypt files to show, watermark and process them for you.
• We do not offer customer-managed keys (bring your own key) today.
• Images shown to many people at once (marketing images, renders, thumbnails, brand assets) and database rows (including extracted catalog values and meeting transcript text) rely on the provider's encryption at rest plus row-level security, not on the per-workspace file key.

5. Identity and access

• Two steps on every new session. A password, then a 6-digit code sent by email. A session lasts up to 12 hours. A password alone reads nothing: the database requires the second step before it returns any workspace data.
• Remember this device (optional). A person may skip the email code on a trusted browser for 30 days. The device token is stored only as a hash.
• Roles and least privilege. Each person has a role in each workspace. Workspace admins manage that workspace; other roles have a subset of permissions. Permission checks run on the server for every action.
• Guests see only what is granted. People outside your company (distributors, licensees, their customers) see only the content your workspace explicitly grants them.
• Downloads are off by default. Workspace admins can download what their workspace uploaded and generated. For everyone else, downloads of sealed PDFs, generated documents, 3D and CAD files and design packs stay off until a workspace admin turns them on.
• Watermarks. Printed sealed drawings carry a watermark naming the workspace, the person's company and the time. Exported files carry an embedded notice naming the workspace, the time and an export ID. The audit trail records who made each print and export. The original drawing content and seal are not changed; the watermark is drawn on top.
• Audit trail. Views, prints, exports, sign-ins and administrative actions are recorded with who, what and when.

6. Application security

• Content Security Policy with a fresh random nonce on every page, no inline or eval scripts in production, and framing blocked except for embeds on the websites a workspace allows. Violation reports are collected with personal data redacted.
• Server-side permission checks. Every product action is a registered capability with its own policy check on the server. The interface is never the security boundary.
• Secure development. Changes ship through a release branch with type checks, linting, a production build and automated tests (including the workspace isolation tests) before deployment. We prefer maintained open-source libraries and check their licenses.
• AI guardrails. Our assistants treat uploaded files, web pages, emails and tool results as data, never as instructions; they never reveal other workspaces' data, rating tables, keys or internal prompts; and their replies are checked for secrets before you see them. We test these rules against a set of attack prompts.
• No third-party tracking. No analytics, advertising or third-party cookies, pixels or scripts on the website or in the app. Fonts are self-hosted.

7. AI and your data

• AI providers are US-based, on paid commercial terms that do not train on your data. Your files are processed in US regions.
• Drawings and customer files go only to providers we hold direct accounts with. If a route cannot meet our requirements, the request fails rather than falling back to a provider or model we did not choose.
• AI output is labeled, carries a disclaimer, and is published only after a person confirms it.
• Pitchlume never presents a guessed value as a real engineering value.

• Zero data retention is requested from each AI provider and is not yet confirmed in writing for every account.

Read the full AI Use and Data Policy.

8. Data residency

• Customer Data is stored in the United States, and your files are processed in US regions.
• We make no statement that only US persons can access the service or its systems. Do not rely on Pitchlume as an export-controlled environment.
• Restricted and regulated data is not allowed or encouraged. Pitchlume is not a government cloud, FedRAMP, GovCloud or CMMC environment. Before files are processed, the uploader declares whether they contain restricted data (ITAR technical data, export-controlled technology with an ECCN, Controlled Unclassified Information and similar categories), our code checks for restricted-data markings before any AI call, and every declaration and consent is recorded. See the Restricted Data Policy.

9. Resilience and backups

• Today: the database is backed up daily by our infrastructure provider. Original uploaded files are stored unchanged with a SHA-256 hash, so we can show that a file has not been altered.
• Status page: a public status page shows the current state of the service and incident notes.
• Not in place yet: point-in-time recovery, a tested restore, and an adopted business continuity and disaster recovery plan.
• We do not publish an uptime commitment today. Any service level is set in your order form. See the Service Levels and Support Policy.

10. Monitoring and incident response

• Monitoring: server and browser errors are captured with personal data and engineering values scrubbed out. Health checks run every 5 minutes. Authentication and database logs from our provider are collected for review. Security-relevant events are written to the audit trail.
• Incident response: we investigate suspected incidents promptly, contain them, and rotate keys where needed. If an incident affects your data, we notify you without undue delay, and within 72 hours after we confirm it, as our Data Processing Addendum states, with what we know and what we are doing. A written incident response plan is drafted and not yet adopted.
• Email kill switch: we can stop all outbound email from a workspace at once if it is misused.

11. Vendors and subprocessors

We review each vendor that touches Customer Data for US hosting, security practices and contract terms (including no training on your data for AI providers) before we use it. We give 30 days' notice before adding or replacing a subprocessor.

See the Subprocessor List.

12. Privacy

• Your company controls the data in its workspace; we process it to provide the service.
• We do not sell or share personal information for advertising.
• Requests to access, export or delete data are handled by email today at info@pitchlume.ai, by our staff. Self-service export and deletion are on our roadmap.

Read the Privacy Policy.

13. Compliance status

What we do not claim

We do not hold a SOC 2 report or certification, ISO 27001 certification, or any other security certification.

We are not ITAR registered, and Pitchlume is not a FedRAMP, GovCloud, CMMC or NIST SP 800-171 environment.

We are not HIPAA compliant and do not accept health records.

We do not claim WCAG conformance; WCAG 2.2 AA is our target and has not been audited.

Our encryption is not end-to-end, and we do not offer customer-managed keys.

We do not publish an uptime guarantee or uptime history today.

We hold no cyber or technology errors-and-omissions insurance today.

14. Documents available on request

Our internal security policies (information security, access control, change management, incident response, business continuity, vendor management, data classification and retention, encryption and key management, logging, secure development, risk assessment, and AI governance) are drafted and not yet formally adopted. Once a policy is adopted, customers and serious prospects can ask for it under a mutual NDA. We can also answer a reasonable security questionnaire. Write to help@pitchlume.ai.

15. Reporting a security issue

Found a security issue? Please tell us at help@pitchlume.ai with the subject "Security". We welcome good-faith reports. Please do not access, change or keep data that is not yours, do not disrupt the service, and give us reasonable time to fix the issue before telling anyone else.

16. Contact

• Security reports and support: help@pitchlume.ai
• Privacy, legal and general questions: info@pitchlume.ai

EraShift Studio LLC. Legal notices by email to info@pitchlume.ai.

Change log