Data Security & NDA
How drawings are protected: encryption, access control, NDA and IP retention
Manufacturing IP lives in the CAD model. The platform protects it at every stage: encrypted transmission and storage, role-based access (only the assigned factory sees your files), NDA terms applied by default, and an audit trail of who accessed what. You can choose to release files only for quoting, or restrict the factory from re-quoting your part to competitors.
1. Transmission and storage
Uploads travel over TLS (HTTPS) and are stored encrypted at rest; file access is tokenized so URLs cannot be shared or hot-linked. Quarantine scanning checks uploads before they enter the workflow.
Files are stored in region-compliant buckets; data handling follows ISO 27001-aligned controls and GDPR principles (data minimization, access logging, erasure on request).
2. Access control
Only the matched factory receives your files — no blanket visibility. Access is time-boxed to the active order and revoked on completion; internal staff access is role-limited and logged.
The platform supports ITAR-style restrictions on request (export-controlled parts, US-person handling) for defense programs; flagged orders are routed and handled separately.
3. NDA and IP retention
NDA terms apply to every quote and order by default; the factory may use your files only to produce your order. Tooling (molds) is owned by you and held under your account; files remain yours — the platform claims no IP in your design.
A “quote-only” mode lets a factory price without downloading geometry (dimensions only), keeping sensitive features private until you release the order.
4. Your controls
Set access preferences per order (release full file, release flat/quote-only, watermark drawings), revoke access any time before production starts, and review the access log on each order.
For sensitive programs: separate supplier pools, non-disclosure per project, and export-controlled routing. Ask for a data-processing agreement for regulated procurement.
Quick reference
| Control | Implementation |
|---|---|
| In transit | TLS/HTTPS, tokenized file URLs |
| At rest | Encrypted object storage |
| Access | Role-based, factory-scoped, time-boxed |
| NDA | Default on all quotes/orders |
| IP | Customer retains all rights; tooling owned |
| Audit | Download/access log per order |
| Compliance | ISO 27001-aligned, GDPR, ITAR on request |
Sources & references
- ISO 27001:2022 — Information security
- GDPR (EU) 2016/679
- Xometry Learning Center — Data Security (public engineering reference)