Infrastructure
- ShareCAD runs on Amazon Web Services. Files and account data are stored in the United States (Ohio).
- Administrative activity on our infrastructure is logged with AWS CloudTrail.
Encryption
- In transit: all connections use HTTPS. File storage refuses unencrypted requests.
- At rest: files are encrypted with AES-256.
Access to files
- File storage is not publicly accessible. A file can be reached only by signed-in members of the account or through a link the account chose to share.
- Sign-in is handled by Amazon Cognito. Account administrators control who is on the account.
- Download links are generated for each request and expire automatically, most within minutes and none after more than an hour, so a copied download URL stops working.
Share links
- Senders can protect a link with a password. Link passwords are stored only as bcrypt hashes.
- Senders can set an expiry date and make a link view-only. These rules are enforced on our servers, not just in the browser.
- Each download through ShareCAD is recorded with the time, IP address and browser, giving the sender a delivery record.
Payments
- Payments are processed by Stripe, a PCI DSS Level 1 certified provider. ShareCAD never stores full card numbers.
Deletion
- Deleting a file removes it permanently. After a subscription ends, files are kept for at least 30 days before they may be deleted, as described in our Terms of Service.
Compliance
ShareCAD is not yet SOC 2 certified. Our infrastructure and payment providers, including Amazon Web Services, Autodesk and Stripe, maintain their own security certifications. We are happy to complete security questionnaires for customers and partners.
ShareCAD is not designed for data that must be stored on systems meeting special government requirements, such as ITAR controlled technical data. See Section 5 of our Terms of Service.
Subprocessors
These providers receive customer data to run the Service. We will update this list before adding a new provider that handles customer files.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, file storage, databases, sign-in (Amazon Cognito) and email delivery. Data is stored in the United States (Ohio). | Files, account data, delivery records | United States (Ohio) |
| Autodesk Platform Services | Converts and displays certain CAD and BIM formats. Files in those formats are sent to Autodesk for processing. | Files in formats that need conversion | United States |
| Stripe | Payment processing and billing. | Billing contact and payment details | United States |
| Google Analytics | Website usage analytics. | Usage and device information | United States |
| Microsoft Clarity | Usage analytics and session recordings. | Usage and device information, page interactions | United States |
| Sentry | Error monitoring, including recordings of sessions where an error occurs. | Error details, page interactions | United States |
| Microsoft 365 | Our business email, including support@sharecad.com. | Messages you send us | United States |
Report a security issue
If you believe you have found a vulnerability, email support@sharecad.com with the details. Please give us a reasonable chance to fix the issue before disclosing it publicly. We do not take legal action against good-faith research that avoids harm to users and their data.