SecurityControl-plane-only architecture

Security isn't a feature here.
It's the architecture.

The Design Engine tells your AI how to build on-brand — it never sees what you build.
Your content stays in your environment. Always.

The Architecture

The brand brain, not the builder.

Design intelligence flows out.

The engine answers one question: what does this brand look and sound like? Colors, typography, layout rules, templates, and build instructions flow outbound to your AI tools over MCP. That's the product — directives, not documents.

Generation happens in your environment.

Your decks and documents are built client-side by your own AI — Claude, Cursor, or any MCP-capable tool — under your existing AI agreements. The content your team creates never transits our infrastructure.

We hold your brand kit. Nothing else.

Logos, fonts, colors, and templates you choose to give us — typically public-facing marketing collateral — plus anonymous quality metrics. That is the entire custody surface.

Data Custody

The whole boundary, in one view.

What we store

Brand collateral you provide: logos, fonts, colors, uploaded templates

Style profiles derived from that collateral

Quality metrics: scores, layout names, slide counts

What transits — never stored

Slide metadata (layout names, titles, word counts) during quality scoring

Scored in memory, discarded on response

Email addresses during brand sharing — resolved to an account ID, then dropped

What never reaches us

The contents of your documents, decks, and diagrams

Your business data, customer data, or files your team generates

Passwords (OAuth-only sign-in) or email addresses in our application tables

AI & Your Data

We operate no AI models.

The engine is deterministic software. It computes design directives from your brand attributes — there is no model to train, so your data is never used for training. By anyone.

AI touches your assets in exactly one place: when you upload brand files, Claude (via the Anthropic API) analyzes them to extract your palette, type system, and visual language. Anthropic does not train on API data. The analysis runs once, and the results become your editable brand profile.

Everything your team generates — every deck, document, and diagram — is produced by your AI tools, under your agreements, in your environment. There is no AI governance surface on our side to review, because there is no generation on our side at all.

Practices

Small surface. Serious hygiene.

Identity is delegated

Sign-in is OAuth-only via Google, GitHub, or Microsoft. We store no passwords, and no email addresses in our application tables — users are referenced everywhere as opaque IDs, including brand-sharing records.

Modern MCP auth

AI-tool connections use OAuth 2.1 with PKCE, dynamic client registration, and RFC 8707 resource binding. Legacy API keys are SHA-256-hashed at rest, one active key per brand, revoked on rotation.

Tenant isolation

Row-level security with owner-only access on every brand table, and a single authorization chokepoint in the engine that every brand-scoped tool routes through — enforced by tests.

Encryption everywhere

TLS for every connection in transit; AES-256 at rest on our database and file storage.

Hardened surface

HSTS, content-security policy, frame-deny, and strict referrer headers across the site. Every API route is authenticated.

Telemetry without PII

Error monitoring is configured to strip personal data before it leaves our stack. Debugging works on event shapes, not on who you are.

Subprocessors

Who we build on.

Supabase

Database, authentication, file storage

Railway

Engine hosting

Vercel

Website hosting

Anthropic

Brand-file analysis (API data not used for model training)

HubSpot

Marketing contacts (website forms only)

Sentry

Error monitoring, PII-stripped

Working through a vendor review?

Architecture and data-flow documentation is available on request, and we'll complete your security questionnaire. Formal certification (SOC 2) is on our roadmap as we scale — the architecture above is why most reviews are short.

Talk to us →