Security
Last updated 2026-06-29
View Trust Center →- Residency
- US-West
- In transit
- TLS 1.2+
- At rest
- AES-256
- AI log retention
- 90 days
Every control below is backed by code or system configuration, verified against our codebase and live systems.
How preset AI protects your design system and the data around it, control by control. The controls below are live in production today; what we're strengthening next is listed separately.
In production today
The controls protecting your workspace, live now.
Encryption everywhere
AES-256 at rest, TLS 1.2+ in transit. HTTPS is enforced; we do not serve unencrypted connections.
Workspace isolation
Row-level security is enabled on every public table (176 today) as one layer of tenant isolation. Service-role and SECURITY DEFINER paths bypass RLS by design and are separately gated and reviewed; the service role is never exposed to the client.
Authentication and sessions
OAuth 2.0 and email/password via Supabase Auth. Sessions use short-lived JSON Web Tokens that refresh automatically and expire. APIs are Bearer-authenticated.
Rate limiting and least privilege
Tiered rate limits (free, pro, enterprise) on our MCP and AI-facing surfaces; administrative paths are separately auth-gated. Access follows least-privilege, and secrets are managed outside the codebase.
Backups and disaster recovery
Continuous write-ahead logging plus daily snapshots. Recovery targets are RPO < 1h and RTO < 4h; a restore drill to validate them is on our roadmap.
Anonymization on deletion and incident response
On account deletion we anonymize audit records, stripping your identifiers rather than dropping the trail, and a documented incident-response process is in place.
Strengthening next
On the roadmap, tracked rather than omitted.
Staff MFA enforcement. Multi-factor authentication required on every staff account.
Application error monitoring. Application-level error tracking across services.
Restore-drill validation. A scheduled drill that exercises our recovery targets end to end.
Formal certifications. SOC 2 Type I, then Type II in 2027. Progress is tracked on the Trust Center.
Subprocessors
The third parties that process customer data on our behalf.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, auth, and infrastructure hosting | Account, workspace, and application data | US-West |
| Anthropic | AI (Claude), primary for complex tasks | Prompts at request time | US |
| OpenAI | AI (embeddings and general tasks) | Prompts at request time | US |
| AI (Gemini), documentation and validation | Prompts at request time | US | |
| Voyage AI | AI (multimodal embeddings for design-system knowledge search) | Design system content, including text and images | US |
| Stripe | Payment processing and billing | Billing and payment data (PCI DSS Level 1) | US |
| Resend | Transactional email delivery | Recipient email address and message content | US |
| Vercel | Application hosting and edge delivery | Application requests and associated metadata | Global (US primary) |
Every subprocessor we rely on is listed here, with its region and purpose. We never train on your data: each AI provider processes prompts under its own data-use terms, which we review for no-training use.
Doing vendor due diligence? Request our security overview at security@presetai.dev.
Security questions or vulnerability reports: security@presetai.dev. We respond within 48 hours and support coordinated, good-faith disclosure; we will not pursue legal action against researchers acting in good faith.