Security notes
Built like a fire stair, unglamorous, load-bearing, and exactly where it should be. The parts you don't see are the parts done most carefully.
Isolation and storage
Workspace isolation is enforced in the database itself, not just the interface. Drawings are stored in private buckets and served through short-lived signed links, minted only after the access check passes.
Payments and access
Documents unlock only on a cryptographically verified payment confirmation from the gateway, never on a browser redirect that can be spoofed. Your Razorpay connection uses the official OAuth flow, so no keys are handled by hand.
Accountability
Every sensitive action, from access granted to invoice raised, is written to an audit log your studio can review. Clients sign in with their own credentials, no shared passwords, no forwarding files over email to lose track of.
The load-bearing parts, done carefully
Drawings sit in private buckets behind short-lived signed links, files unlock only on a verified payment, and every sensitive action is written down. The parts you don't see are the parts done most carefully.
- Private storage, signed links
- Unlock only on verified payment
- An audit log on every action
Off the ledger, onto the workspace
Drawings on public storage, one link away from anyone.
Private buckets served by short-lived signed links.
A redirect back from the payment page opens the files.
Only a cryptographically verified confirmation unlocks.
Nobody can say who saw what, or when.
An audit log on every sensitive action, reviewable anytime.
Built to carry the weight
Isolation and storage
Database-level isolation, private buckets, and short-lived signed links minted only after the access check passes.
Payments and access
Files unlock only on a cryptographically verified confirmation, never a spoofable redirect. Razorpay connects via OAuth.
Accountability
An audit log on every sensitive action, and individual client credentials, no shared passwords, no forwarded files.
Everything, in the file
Isolation & storage
- Database-level isolation
- Private buckets
- Short-lived signed links
Payments & access
- Unlock only on verified payment
- Never a spoofable redirect
- Razorpay via OAuth, no manual keys
Accountability
- Audit log on every action
- Individual client credentials
- No shared passwords or forwarded files
Built like a fire stair, unglamorous, load-bearing, and exactly where it should be.
Questions, answered
Straight answers about security notes, in plain language.
Ask us anythingIn private buckets, served through short-lived signed links minted only after the access check passes, so a link can't be shared indefinitely or hotlinked.
A cryptographically verified payment confirmation from the gateway, never a browser redirect that can be spoofed.
With their own individual credentials (no shared passwords and no forwarding files over email) and every sensitive action is written to an audit log you can review.