Security, data and neutrality
What we store, where, who can see it and how the catalog is built. No fine print: if any of this changes, we update it here.
Where the service runs
AV Layout runs on Cloudflare: the server is a Cloudflare Worker and data is stored in Cloudflare Workers KV. Every connection is encrypted over HTTPS (browsers refuse unencrypted connections: HSTS).
We back up the database daily to Cloudflare R2 and keep the last 30 days. Sessions, daily quotas and one-time codes are not backed up: they expire on their own.
What we store and who can see it
Your account: name, email, language, your subscription status and, if you fill them in, your company details. Your password is not stored: we store a hash of it (see below).
Your projects: the plans and diagrams you draw, tied to your account. Only your account can see them. If you share a link, anyone with that link can see it until it expires or you revoke it. A distributor's admin sees how many projects each account on their team has, not what is in them.
Distributor catalogs and prices: the brands, products and price lists a distributor uploads are visible only to that distributor's accounts. No other account or distributor can see them.
Your own devices: on Tier 1, what you add to the catalog is reviewed before the community sees it; on Tier 2 it stays private to you and your team.
As with any online service, all of this lives in our database, and only the service administrator has access to it. We don't sell your data or use it for advertising.
How we protect your account
Passwords are stored with PBKDF2-SHA256, with a unique salt per person and 100,000 iterations. When you create one, we reject passwords that appear in known breaches (we check Have I Been Pwned by sending only the first 5 characters of a hash, never the password).
After 8 failed attempts, the account is locked for 15 minutes. You can turn on an email code for every sign-in (it is mandatory for distributor admins).
Sessions last 12 hours and use an HttpOnly, Secure, SameSite=Strict cookie. Only a hash of the session ID is stored in the database. An account can be signed in on up to 2 devices at a time.
Every page has a nonce-based content security policy (only code signed by the server in that response can run), can't be embedded in other sites, sends no referrer and doesn't ask for camera, microphone or location access. Requests that change data are only accepted from the site itself.
Payments
Card payments are processed by Paddle (Paddle.com Market Ltd), which acts as our authorized reseller (Merchant of Record): Paddle charges you, issues the invoice and handles your country's taxes. Your card details go straight to Paddle and never pass through or get stored on our servers. From Paddle we only receive your subscription status, through signed notifications that we verify.
If you choose to pay with crypto (USDC), the payment goes straight to our wallet and the transaction is recorded on the public blockchain, like any payment on that network.
Email and other providers
These are the providers we use to run the service, each one only for its own job:
- Cloudflare: server, database, backups, the AI draft feature (Workers AI, only on accounts where it is enabled) and the 3D view library (cdnjs).
- Paddle: subscription billing.
- Resend: sending the service emails (confirmation, password recovery, notices) and receiving the emails you send us.
- Have I Been Pwned: the anonymous breached-password check described above.
We don't use Google Analytics, social media pixels or advertising cookies.
Your data, under your control
You can download each project as a file (.avlayout.json) from “Projects” → “Download file”, and open it again whenever you want.
You can delete your account from “My account” (if you have a subscription, cancel it first): your account, your projects and the links you shared are deleted. Daily backups roll over on their own, and after 30 days nothing is left.
To request a copy of all your data or ask anything else about privacy, write to us at info@xdgtal.com. More details in our Privacy policy (in Spanish).
Catalog neutrality
The shared catalog has 2,979 devices from 63 brands, plus 31 generic devices (display, camera, microphone, speaker and more) so you can specify without tying yourself to a brand.
1,405 devices have their inputs and outputs entered one by one from each manufacturer's official datasheet or manual, and the app validates cables against that data. When a device has no reliable datasheet, we don't make up ports: you can still place it, without validation.
The catalog has no prices. Distributors can upload their own brands and price lists, but only their accounts see them: it doesn't change what anyone else sees.
From your account you can suggest a missing device; on Tier 1 we review it before adding it to the shared catalog.
What we don't have (yet)
We don't hold our own security certifications (such as SOC 2 or ISO 27001). If your company needs a security questionnaire or a data processing agreement, write to us and we'll look into it.
Found a security issue? Let us know at info@xdgtal.com (also listed in /.well-known/security.txt).