Security for your CAD data and engineering IP
ISO 27001 certified
SOC 2 Type II attested
SAML SSO
Audit logs
%22%20stroke%3D%22rgba(255%2C%20255%2C%20255%2C%200.8)%22%20stroke-width%3D%220.4%22%2F%3E%3C%2Fsvg%3E)
Our security controls are audited by independent third parties every year.
ISO 27001 certified
Our information security management system is independently audited and certified to ISO/IEC 27001.
From encryption and sign-in to permissions and audit trails.
Encryption at rest and in transit
Customer data is protected with AES-256 encryption at rest and TLS 1.2+ in transit.
Role-based access control
Workspace and project roles decide who can view, edit and release each file. Remove someone, and their synced files and browser access go with them.
SAML 2.0 single sign-on
Sign in through your existing identity provider, so your IT team manages access centrally. Available on the Enterprise plan.
Personnel security
Personnel undergo background checks, sign confidentiality agreements, and complete security awareness training on hire and annually. Access to customer data is scoped by role, reviewed quarterly, and revoked on offboarding.
Tenant isolation
Customer workspaces are logically separated within the managed cloud environment.
Audit logs
Platform and project activity is logged with user, timestamp and action, retained for security review and compliance evidence.
Protect engineering data from first upload through review, revision, release, and external collaboration.
01 — CONTROL DESIGN CHANGES
Check-out and version history
Checking out a file reserves it while someone edits it, so there are no conflicting copies. Each check-in creates a new version with a note, and earlier versions stay available to view or restore.
02 — CONTROL APPROVALS
Approval before release
Changes are reviewed and signed off before release, so manufacturing and suppliers work from an approved revision, with a record of who approved it.
03 — CONTROL EXTERNAL ACCESS
View-only guest sharing
Share specific files with suppliers and customers as guests. They can view, measure and comment in the browser, but can’t edit, check out or release files, and never see the rest of your workspace. You decide whether they can download.
Identity
SAML SSO
Access
Roles and permissions
Sharing
View-only guests
Traceability
Audit and version history
Secure, resilient infrastructure.
CAD ROOMS runs on AWS, with customer data hosted in a dedicated AWS region and regional deployment options for Enterprise.
AWS cloud infrastructure
CAD ROOMS runs on managed AWS infrastructure with automated monitoring and a defined incident response process.
Automated backups
Data is backed up automatically under our ISO 27001 certified controls, so it can be recovered if a service or data issue occurs.
Regional data residency
Customer data is hosted in a dedicated AWS region. Regional deployment options are available for Enterprise customers.
Enterprise deployment options
Need regional hosting or your own storage bucket? We offer these as custom setups for Enterprise customers.
Security questions, answered.
Is CAD ROOMS ISO 27001 certified?
Yes. CAD ROOMS operates an ISO 27001-certified information security management system.
Is CAD ROOMS SOC 2 Type II attested?
Yes. CAD ROOMS has completed a SOC 2 Type II attestation, providing independent assurance over relevant security controls.
How is customer data encrypted?
CAD ROOMS protects data at rest using AES-256 encryption and data in transit using TLS 1.2+.
Does CAD ROOMS support single sign-on (SSO)?
Yes. SAML 2.0 SSO is available for Enterprise customers.
Where is customer data hosted?
CAD ROOMS runs on AWS, and customer data is hosted in a dedicated AWS region. Regional deployment options, including your own storage bucket, are available for Enterprise customers.
Is our data used to train AI?
No. CAD ROOMS does not use customer data, files or metadata to train AI models — ours or any third party’s.
Can suppliers download our CAD files?
Only if you allow it. When you share a file with a guest, you choose whether they can view it or also download it. View-only guests can view, measure and comment in the browser, but can’t edit, check out or release files.
What happens when someone leaves the team?
Remove them from the workspace or project, and the files synced to their computer are automatically removed and their browser access is revoked.
Can we use our own storage bucket?
Yes, as a custom setup for Enterprise customers. Contact us to scope your storage and hosting requirements.
How can I request CAD ROOMS security documentation?
Email support@cadrooms.com and we’ll share our ISO 27001 certificate, SOC 2 Type II report and DPA for your security review.
Do you provide a DPA?
Yes. A GDPR-compliant Data Processing Agreement (DPA) is available on request.