Draft prepared for legal review. Replace placeholders before publishing.
Legal
Data Protection
CipherFab is committed to protecting customer, prospect, supplier, and employee information through technical safeguards, organizational controls, and partner governance aligned with digital manufacturing industry standards.
Our Commitment
Your designs, specifications, and business information are central to what you entrust to CipherFab. We treat protection of customer data and intellectual property as a core operational priority, not an afterthought.
CipherFab maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and loss across our platform, internal operations, and manufacturing partner network.
Scope of Protected Information
This overview addresses protection of:
- CAD files, drawings, BOMs, specifications, and engineering notes uploaded for quoting or production.
- Account credentials, contact details, billing data, and communications.
- Order history, quality records, inspection data, and logistics information.
- Supplier and partner information shared to operate the manufacturing network.
Technical Safeguards
CipherFab implements industry-standard technical controls, including:
- Encryption in transit using modern TLS protocols for website, portal, and API communications.
- Encryption at rest for stored customer data and design files where appropriate to risk profile.
- Role-based access controls limiting data access to authorized personnel and systems on a need-to-know basis.
- Multi-factor authentication for administrative and high-privilege platform access.
- Network segmentation, firewalls, and secure cloud infrastructure configurations.
- Logging, monitoring, and alerting for suspicious activity on systems handling customer data.
- Endpoint detection and vulnerability management for corporate and production-support environments.
- Regular backups and tested recovery procedures for business-critical systems.
Organizational Controls
Technology alone is insufficient without strong process discipline. CipherFab's organizational controls include:
- Security and privacy training for employees with access to customer information.
- Background screening for roles with elevated data access, where permitted by law.
- Documented policies for acceptable use, incident response, and vendor management.
- Confidentiality obligations in employment and contractor agreements.
- Periodic review of access rights and revocation upon role change or termination.
- Secure software development practices for platform features handling uploads and orders.
Design IP & Confidentiality
Customer designs remain your intellectual property. CipherFab uses uploaded files only to provide requested services such as quoting, design-for-manufacturability review, production, inspection, and support.
Where appropriate, CipherFab limits partner visibility to the minimum files and metadata required for assigned work. Identifying customer information may be removed or anonymized in manufacturing packages when consistent with order requirements.
Mutual non-disclosure agreements are available for customers requiring additional contractual confidentiality assurances.
Manufacturing Partner Governance
CipherFab's partner network is vetted for capability, quality, and information-handling practices. Partners must agree to confidentiality, data protection, and acceptable-use obligations before receiving customer data.
Partners may access customer specifications only for orders they are assigned to fulfill. They are prohibited from retaining, sharing, or using customer designs for unrelated production or competitive purposes.
CipherFab performs ongoing partner management, including audits and corrective actions where deficiencies are identified.
Export-Controlled & Regulated Data
Customers are responsible for determining whether designs or technical data are subject to export control regulations such as ITAR or EAR. Controlled data should only be submitted when CipherFab has authorized the project and implemented appropriate handling controls.
Where supported, CipherFab may apply enhanced controls for regulated workloads, including restricted access environments, geographic processing limits, and additional screening procedures.
Unauthorized upload of controlled technical data may result in order cancellation and account suspension.
AI & Analytics Use of Customer Data
CipherFab may analyze operational and de-identified production metadata to improve quoting, quality, and platform reliability.
CipherFab does not use identifiable customer designs to train generative AI models unless expressly agreed in writing. Aggregated and irreversibly de-identified data may be used for statistical analysis and service improvement.
Vendor & Subprocessor Management
CipherFab uses cloud hosting, payment, communications, analytics, and other subprocessors to operate the Services. Vendors are assessed for security and privacy practices and bound by contractual data protection obligations appropriate to the services they provide.
A list of key subprocessors may be provided upon request or published in supplementary documentation as our vendor ecosystem evolves.
Monitoring & Incident Response
CipherFab monitors systems for security events and maintains incident response procedures to investigate, contain, remediate, and document suspected breaches.
Where required by law or contractual obligation, CipherFab will notify affected customers and regulators of personal data breaches without undue delay.
Customers should report suspected security issues or unauthorized access involving CipherFab systems promptly through our contact channels.
Testing & Security Assurance
CipherFab conducts security testing appropriate to risk, which may include vulnerability scanning, penetration testing, and third-party assessments of critical platform components.
Findings are remediated according to severity and business impact. Security posture is reviewed periodically as threats and platform capabilities evolve.
Processing & Retention
Personal and project data is processed only for legitimate business purposes such as quoting, order fulfillment, support, billing, compliance, and service improvement.
Data is retained only as long as necessary for these purposes and applicable legal obligations. Design files may be deleted or archived according to customer instructions and retention schedules where supported.
Cross-Border Transfers
CipherFab and its partners may process data in multiple countries. Cross-border transfers are subject to appropriate safeguards such as data processing agreements, standard contractual clauses, and supplementary technical measures where required.
Data Subject & Customer Requests
CipherFab maintains procedures for handling privacy rights requests, including access, correction, deletion, restriction, and portability requests under applicable law.
Customers may also request information about how design files are handled, partner access, or data deletion following order completion, subject to legal and quality-record retention requirements.
Employee & Contractor Access
Access to customer data is granted on least-privilege principles. Personnel with access receive training on confidentiality and secure handling. Access is logged and reviewed.
Your Responsibilities
Data protection is a shared responsibility. Customers should use strong passwords, enable available account security features, limit account sharing, and classify uploads appropriately—especially for sensitive or export-controlled projects.
Promptly notify CipherFab if you suspect unauthorized access to your account or improper disclosure of your designs.
Related Policies
Review our other legal and data protection documents for a complete understanding of how CipherFab operates.
Let's Build Something Great Together
Get a Free Instant QuoteCipherFAB simplifies custom manufacturing through a global network of vetted suppliers, delivering quality components with transparency, speed, and reliability.