Security at UxxU

UxxU is built to keep software architecture work private, available, and accessible only to the people and organisations it belongs to. Security is applied across the browser, API, application, and cloud infrastructure.

Last reviewed: 28 July 2026

Infrastructure

Layered cloud architecture

The public website and application are delivered through AWS cloud services. The platform separates edge delivery, authenticated APIs, application processing, relational data, object storage, and real-time collaboration state.

The primary application and data region is AWS US East (N. Virginia), identified by AWS as us-east-1. CloudFront serves public content through its global edge network.

Edge and transport
HTTPS/TLS protects data in transit. CloudFront security policies include HSTS, Content Security Policy, referrer controls, and content-type protection.
Application
API Gateway and serverless application functions handle requests behind authentication and authorisation controls. Public authentication and form endpoints are kept separate from protected application actions.
Data services
PostgreSQL on Amazon RDS stores structured application data. Amazon S3 stores documents and generated assets. Data in RDS and S3 is encrypted at rest, while DynamoDB supports connection and collaboration state.

Safeguards

Protection throughout the service

Secure sessions

Browser sessions use Secure, HttpOnly, SameSite cookies. Short-lived access tokens are not stored in localStorage, and refresh credentials are rotated and validated against server-side hashed records.

Account protection

Passwords are stored as one-way bcrypt hashes. Password resets use time-limited codes, reset attempts are rate controlled, and changing a password revokes existing refresh sessions.

Authorised access

Protected API requests pass through backend authorisation. Access to projects, diagrams, organisations, licences, and API keys is evaluated using the authenticated user and organisation context.

Data handling

Account and architecture records are held in PostgreSQL on Amazon RDS, while documents and generated assets use Amazon S3. Data stored in RDS and S3 is encrypted at rest. Retention routines minimise or remove selected records when they are no longer needed.

Operations

Monitoring and minimisation

  • Backups. Automated Amazon RDS database backups run daily and are retained for 14 days. Backup data is encrypted at rest in the same AWS region as the production database.
  • Internal access. Access to production data is limited to the founder, for support and incident response.
  • Enterprise SSO. SAML and organisation-managed single sign-on are not currently supported.
  • Application logging is designed to avoid exposing passwords, tokens, cookies, message contents, and arbitrary sensitive fields.
  • Production application logs have a configured 90-day retention period.
  • Google reCAPTCHA protects selected registration and public forms against automated abuse.
  • Privacy controls let signed-in users export account data and submit an account-erasure request.

Shared responsibility

Keeping your workspace secure

Customers remain responsible for controlling who they invite, assigning appropriate organisation access, protecting their sign-in credentials and API keys, and avoiding unnecessary personal or sensitive information in architecture content.

UxxU does not currently claim ISO 27001, SOC 2, or another independent security certification. This page describes implemented platform controls and is updated as those controls evolve.

Review our Data Processing Agreement and current subprocessor list for contractual data-protection terms and provider details.

The hosted UxxU application does not send Customer architecture content to OpenAI, Anthropic, or another external LLM provider. UxxU MCP integrations use the Customer's chosen AI environment, provider relationship, and configuration.

Report a security concern

If you believe you have found a vulnerability or security issue, contact us with a clear description and the steps needed to reproduce it. Please do not access, modify, or download data that does not belong to you.

info@uxxu.io