Security

Clear controls. Honest limits.

Last updated 1 October 2026 · early access

Deployment

ArchiStudio uses Supabase for authentication, database and file storage, and Vercel for app delivery. Confirm the production region, backup retention and processing locations in your deployment agreement; AI processing can occur outside the storage region.

Workspace access

Database access is scoped to workspace membership. Owners administer their team. Private files use signed access links. Settings shows the live storage configuration; a failed status check must not be interpreted as confirmation of access controls.

Files and links

Private workspace files use signed links with limited token validity. Public marketing examples are kept separately. Anyone holding an issued link can access the file. Closing a share stops new links being issued, but CDN and browser caches can outlast token expiry. Downloaded copies cannot be revoked.

Sign-in

Email sign-in, magic links and password reset are available. Company SSO is not available in this release.

Generation

Prompts and selected reference files are sent to the chosen engine providers. Their processing, retention and training terms must be assessed for your use case; ArchiStudio does not promise a blanket no-training policy across all engines.

Recovery

Model drafts and recent checkpoints are kept in the current browser, scoped to the signed-in account. Clearing site data removes them. Save a workspace version or download a GLB for a separate copy. Browser drafts are not a cloud backup.

Audit history

Project, material and asset changes record the action, actor, changed field names and time. Owners and admins can read the history. This is an application audit trail, not a certified or externally immutable archive.

Deleting

Deleting a file attempts to remove its storage object before its library record. Project deletion, downloaded copies, browser drafts, backups and provider retention have separate lifecycles. Contact hello@iskalegroup.com for workspace deletion.

Certifications

ArchiStudio is in early access and does not hold SOC 2 or ISO 27001. Ask for the deployment-specific controls and subprocessor agreements before using confidential project data.

Reporting a vulnerability

Email hello@iskalegroup.com with the subject Security. Respect other customers' data when reporting an issue.

Sub-processors

Services used by the product and their purposes. Confirm the enabled services and contractual terms for your deployment.

PrivacyTerms