Trust center
Security, privacy, and
how we use AI.
How preset AI handles your data, control by control: what is live in production today, and what is still on the roadmap.
customer datasets used to train AI models. Ever. Your design system and everything generated from it are never training data.
- Data residency
- US-West
- Encryption at rest
- AES-256
- AI log retention
- 90 days
- Recovery target
- RPO < 1h
preset AI is in early access. Everything in the sections below is live today; the compliance roadmap shows what is committed and when. Live items are backed by code or system configuration, not intentions.
Security
The controls protecting your workspace, in production today.
Encryption everywhere
AES-256 at rest, TLS 1.2+ in transit. HTTPS is enforced; we do not serve unencrypted connections.
Workspace isolation
Row-level security is enabled on every public table (176 today) as one layer of tenant isolation. Service-role and SECURITY DEFINER paths bypass RLS by design and are separately gated and reviewed; the service role is never exposed to the client.
Authentication and sessions
OAuth 2.0 and email/password via Supabase Auth. Sessions use short-lived JSON Web Tokens that refresh automatically and expire. APIs are Bearer-authenticated.
Rate limiting and least privilege
Tiered rate limits (free, pro, enterprise) on our MCP and AI-facing surfaces; administrative paths are separately auth-gated. Access follows least-privilege, and secrets are managed outside the codebase.
Backups
Continuous write-ahead log archiving, verified running in production on 2026-07-29. Daily physical snapshots are configured on our infrastructure plan; that setting was last confirmed on 2026-02-26 and has not been re-checked since, so we state it as configured rather than currently verified.
Recovery targets
RPO < 1h and RTO < 4h are stated targets, not measured results. No restore drill has exercised them end to end yet, and our point-in-time-recovery retention window is still being confirmed, so treat both numbers as objectives rather than commitments.
Anonymization on deletion
On account deletion we anonymize audit records, stripping your identifiers rather than dropping the trail.
Incident response
Security reports reach a named owner at security@presetai.dev. Our data-processing addendum sets a breach-notification commitment, but that addendum is a draft pending counsel review: until it is executed with you, the commitment is drafted rather than binding. A written internal runbook and a rehearsed response drill are also still in progress. Our response path is staffed and named, not yet formally exercised or contractually in force.
Privacy and your data
What we collect, how long we keep it, and the controls you hold over it.
Delete your account
Self-serve deletion removes or anonymizes your personal data: usage telemetry and AI request logs are deleted, and audit records are anonymized. Deleting an uploaded knowledge item also attempts removal of the origin storage record for that file; we verified the successful path on live storage on 2026-08-11. Cached-response behaviour was not measured: Supabase documents automatic edge invalidation within up to 60 seconds when Smart CDN is enabled, while browser caches may retain a previously fetched response for its cache-control lifetime. Our applicable CDN configuration, and the layer responsible for the cached 200 we observed, were not verified. The removal is best-effort: the app attempts it; an API error is logged but is neither surfaced nor retried, and a request that succeeds having removed nothing is not detected at all, because the app does not inspect what the response says it removed. One thing is unlinked rather than erased: product feedback keeps its text and any attached screenshot, so treat that as unlinking. Organization-owned records and routine backups follow their retention policy. Erasure of feedback is available on request, by hand.
Export your data
A machine-readable export of your account data, with AI usage included as a summary. It is account-scoped: it covers your profile, memberships, design systems, tokens, presets, patterns and skills, and it does not include uploaded files, feedback screenshots, raw AI log rows, or provider connection metadata. It supports the GDPR right to data portability (Article 20) for that account data; it is not a full workspace export.
Conversation and prompt retention
AI logs are auto-purged after 90 days, swept daily. Neither prompts nor responses are stored in full: we keep a one-way hash of the prompt plus a short, PII-redacted preview of each side of the exchange, capped at 500 characters apiece.
Where your data lives and who can reach it
Stored in Supabase (US-West). Access is governed by row-level security and a documented role model.
Read the full privacy policy for the complete detail.
AI principles
We are a tool that uses AI to govern the UI that AI generates. How we handle AI is the center of our trust posture, not a footnote.
We never train models on your data
Your design system, components, tokens, files, and generated output are never used to train any AI model. Third-party providers process prompts under their API and business data-use terms; we select offerings intended for no-training use, and where a provider exposes training as an account setting we disable it. Published provider terms are linked below; where a provider has no published term, the control is an account setting we hold.
Which providers process your prompts
Anthropic, OpenAI, Google, and Voyage AI process your content on our behalf. Anthropic, OpenAI, and Google receive prompts at request time. Voyage AI receives design-system content, including images, to build the embeddings behind knowledge search, so more than prompt text leaves preset on that path. We document when data leaves preset and which provider receives it. See subprocessors below.
You own your work and its output
You retain ownership of your design systems and everything generated from them. We never claim ownership of the output it generates.
Subprocessors
The principal third parties that process customer data on our behalf, and why. We update this list as our infrastructure changes.
| Subprocessor | Purpose | Data | Region |
|---|---|---|---|
| Supabase | Database, auth, and infrastructure hosting | Account, workspace, and application data | US-West |
| Anthropic | AI (Claude), primary for complex tasks | Prompts at request time | US |
| OpenAI | AI (embeddings and general tasks) | Prompts at request time | US |
| AI (Gemini), documentation and validation | Prompts at request time | US | |
| Voyage AI | AI (multimodal embeddings for design-system knowledge search) | Design system content, including text and images | US |
| Stripe | Payment processing and billing | Billing and payment data (PCI DSS Level 1) | US |
| Resend | Transactional email delivery | Recipient email address and message content | US |
| Vercel | Application hosting and edge delivery | Application requests and associated metadata | Global (US primary) |
We never train on your data. Each AI provider processes prompts under its own data-use terms, which we review for no-training use: Anthropic, OpenAI, Google (Gemini).
Compliance roadmap
Where we are today and what is intentionally ahead. We would rather show the roadmap than overclaim.
| Standard | Status | Timeline |
|---|---|---|
| GDPR support controls | Live | Deletion, export, retention, and policy controls implemented |
| CCPA compliance | Partial | Deletion live; formal process by Q3 2026 |
| SOC 2 Type I | Planned | H2 2026 |
| SOC 2 Type II | Planned | 2027 |
| ISO 27001 | Planned | To be scoped |
| EU AI Act monitoring | Planned | Ongoing |
| HIPAA | Not applicable | Not applicable; no health data is processed |
Report a vulnerability
Found a security issue? Tell us. We respond within 48 hours and keep you updated through resolution. We support coordinated, good-faith disclosure and will not pursue legal action against researchers acting in good faith.
Legal documents
The agreements and policies that govern your use of preset AI. One canonical copy of each lives here.
How we collect, use, and protect information across the website and the Platform.
The terms governing your access to and use of preset AI.
The controls protecting your workspace, control by control.
Data Processing Addendum
For customers who need a DPA for GDPR or CCPA compliance. Available on request at hello@presetai.dev.
We hold this page to an internal readiness review. We do not mark a commitment live until a control backs it, and if anything here ever diverges from how the product behaves, we treat that as a bug and fix it. A source of truth, enforced against drift, is exactly what preset sells. We hold ourselves to it too.
Every item marked live is backed by code or system configuration, verified against our codebase and live systems in June 2026. Planned items are tracked, not yet in effect.
Last verified 2026-06-27 · fndd, LLC