Security | CadPeek

Policy details

Local-first viewing

When you open a DWG or DXF in the viewer without clicking Share, parsing happens in your browser using WebAssembly CAD engines. Your drawing bytes do not leave your device during local review.

Share link security

Share URLs use unguessable UUID identifiers.
Files are served over HTTPS only.
Links expire after 90 days by default.
Recipients get view-only access no edit or re-download of source DWG on Free tier.

Account security

Passwords are hashed with scrypt before storage. Sessions use HTTP-only cookies. Email verification is required for registration to reduce fake accounts.

Infrastructure

Production deployments use TLS 1.2+, regular dependency updates, and restricted access to upload storage. We monitor for abuse and rate-limit authentication endpoints.

Report a vulnerability

Contact security@cadpeek.com with responsible disclosure details. We aim to respond within 72 hours.

Policy FAQ

Is traffic encrypted?

Yes. All site traffic uses HTTPS/TLS. Share links are delivered over encrypted connections.

How are passwords stored?

Passwords are hashed with industry-standard algorithms. We never store plaintext passwords.

Do you perform security audits?

We follow secure development practices and plan third-party penetration tests before enterprise SSO launch.

Can I use CadPeek on a restricted corporate network?

The app requires HTTPS access to our domain and CDN font assets. IT may need to allowlist cadpeek.com and font CDNs.

What happens if a share link leaks?

Rotate or delete the share from your account. Links are unlisted but not password-protected on free tier treat URLs as confidential.

Is local parsing secure?

Local parsing keeps files on your device ideal for confidential bid sets. Nothing leaves the browser until you choose Share.