Trust center
Security, privacy, and
how we use AI.
How preset AI handles your data, control by control: what is live in production today, and what is still on the roadmap.
customer datasets used to train AI models. Ever. Your design system and everything generated from it are never training data.
- Data residency
- US-West
- Encryption at rest
- AES-256
- AI log retention
- 90 days
- Recovery target
- RPO < 1h
preset AI is in early access. Everything in the sections below is live today; the compliance roadmap shows what is committed and when. Live items are backed by code or system configuration, not intentions.
Security
The controls protecting your workspace, in production today.
Encryption everywhere
AES-256 at rest, TLS 1.2+ in transit. HTTPS is enforced; we do not serve unencrypted connections.
Workspace isolation
Row-level security is enabled on every public table (176 today) as one layer of tenant isolation. Service-role and SECURITY DEFINER paths bypass RLS by design and are separately gated and reviewed; the service role is never exposed to the client.
Authentication and sessions
OAuth 2.0 and email/password via Supabase Auth. Sessions use short-lived JSON Web Tokens that refresh automatically and expire. APIs are Bearer-authenticated.
Rate limiting and least privilege
Tiered rate limits (free, pro, enterprise) on our MCP and AI-facing surfaces; administrative paths are separately auth-gated. Access follows least-privilege, and secrets are managed outside the codebase.
Backups and disaster recovery
Continuous write-ahead logging plus daily snapshots. Recovery targets are RPO < 1h and RTO < 4h; a restore drill to validate them is on our roadmap.
Anonymization on deletion and incident response
On account deletion we anonymize audit records, stripping your identifiers rather than dropping the trail, and a documented incident-response process is in place.
Privacy and your data
What we collect, how long we keep it, and the controls you hold over it.
Delete your account
Self-serve deletion removes or anonymizes your personal data: telemetry is deleted and audit records are anonymized. Organization-owned records and routine backups follow their retention policy. Available in-product and on request.
Export your data
A machine-readable export of your account data, with AI usage included as a summary, honoring the GDPR right to data portability (Article 20).
Conversation and prompt retention
AI logs are auto-purged after 90 days. Prompts are never stored in full: we keep a one-way hash plus a short, PII-redacted preview (at most 500 characters).
Where your data lives and who can reach it
Stored in Supabase (US-West). Access is governed by row-level security and a documented role model.
Read the full privacy policy for the complete detail.
AI principles
We are a tool that uses AI to govern the UI that AI generates. How we handle AI is the center of our trust posture, not a footnote.
We never train models on your data
Your design system, components, tokens, files, and generated output are never used to train any AI model. Third-party providers process prompts under their API and business data-use terms; we select offerings intended for no-training use. Provider-specific terms are linked below.
Which providers process your prompts
Anthropic, OpenAI, and Google process prompts on our behalf. We document when data leaves preset and which provider receives it. See subprocessors below.
You own your work and its output
You retain ownership of your design systems and everything generated from them. We never claim ownership of the output it generates.
Subprocessors
The principal third parties that process customer data on our behalf, and why. We update this list as our infrastructure changes.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, auth, and infrastructure hosting | Account, workspace, and application data | US-West |
| Anthropic | AI (Claude), primary for complex tasks | Prompts at request time | US |
| OpenAI | AI (embeddings and general tasks) | Prompts at request time | US |
| AI (Gemini), documentation and validation | Prompts at request time | US | |
| Voyage AI | AI (multimodal embeddings for design-system knowledge search) | Design system content, including text and images | US |
| Stripe | Payment processing and billing | Billing and payment data (PCI DSS Level 1) | US |
| Resend | Transactional email delivery | Recipient email address and message content | US |
| Vercel | Application hosting and edge delivery | Application requests and associated metadata | Global (US primary) |
We never train on your data. Each AI provider processes prompts under its own data-use terms, which we review for no-training use: Anthropic, OpenAI, Google (Gemini).
Compliance roadmap
Where we are today and what is intentionally ahead. We would rather show the roadmap than overclaim.
| Standard | Status | Timeline |
|---|---|---|
| GDPR support controls | Live | Deletion, export, retention, and policy controls implemented |
| CCPA compliance | Partial | Deletion live; formal process by Q3 2026 |
| SOC 2 Type I | Planned | H2 2026 |
| SOC 2 Type II | Planned | 2027 |
| ISO 27001 | Planned | To be scoped |
| EU AI Act monitoring | Planned | Ongoing |
| HIPAA | Not applicable | Not applicable; no health data is processed |
Report a vulnerability
Found a security issue? Tell us. We respond within 48 hours and keep you updated through resolution. We support coordinated, good-faith disclosure and will not pursue legal action against researchers acting in good faith.
Legal documents
The agreements and policies that govern your use of preset AI. One canonical copy of each lives here.
How we collect, use, and protect information across the website and the Platform.
The terms governing your access to and use of preset AI.
The controls protecting your workspace, control by control.
Data Processing Addendum
For customers who need a DPA for GDPR or CCPA compliance. Available on request at hello@presetai.dev.
We hold this page to an internal readiness review. We do not mark a commitment live until a control backs it, and if anything here ever diverges from how the product behaves, we treat that as a bug and fix it. A source of truth, enforced against drift, is exactly what preset sells. We hold ourselves to it too.
Every item marked live is backed by code or system configuration, verified against our codebase and live systems in June 2026. Planned items are tracked, not yet in effect.
Last verified 2026-06-27 · fndd, LLC