Security Measures

1. Scope

This document describes technical and organisational measures applied to Decret (the Service) by its operator (Decret; the operator’s identity is given in the Legal Notice). It is provided for due diligence. It is not an independent audit report, penetration-test certificate, or attestation under SOC 2 or ISO/IEC 27001.

Related documents: Privacy Policy; Data Processing Agreement; Terms of Service.

2. Subject matter

The Service is a business workspace for the preparation of draft construction-project documentation from drawings, specifications, contracts, and related files. Those materials may be commercially sensitive and may contain personal data. Customer Content is treated as confidential under the Terms of Service. Personal data is processed as described in the Privacy Policy and the Data Processing Agreement.

Outputs remain drafts until reviewed by the Customer’s competent person. Platform security does not discharge the Customer’s professional duties.

3. Standards

Decret is not presently certified under SOC 2, ISO/IEC 27001, ISO/IEC 27701, Cyber Essentials, PCI-DSS, HIPAA, or equivalent schemes. Security controls are designed with reference to widely recognised frameworks, including the control themes commonly associated with ISO/IEC 27001 and SOC 2.

Decret has no certification programme under way.

4. Architecture

The Service is a React and Next.js application operated as a long-running process. Public DNS for decret.ai is provided by Cloudflare. Traffic is proxied to origin compute in the Service’s Amazon Web Services account. Application compute, the database, and project file storage are operated in AWS Europe (Frankfurt) (eu-central-1) and are reached via Cloudflare.

Present deployment:

• Application data (users, sessions, hashed passwords, authentication tokens, project records): PostgreSQL on Amazon RDS in eu-central-1, in a private network, encrypted at rest, with automated backups and point-in-time recovery over seven (7) days.
• Project files and generated outputs: a private, versioned Amazon S3 bucket in eu-central-1, encrypted at rest by the provider.
• Background work: slow tasks (including AI analysis) run in a separate worker process on the same host, reading and writing the same database and bucket.
• Mail: the Resend HTTP API for outbound mail (verification, password reset and notifications); Cloudflare Email Routing for inbound mail to project addresses; Google Workspace for Decret’s mailboxes at decret.ai, its contact addresses included. Local development uses an outbox in its own database and does not send. Amazon SES is not used.
• Payments: Stripe-hosted checkout and customer portal. Card numbers are entered on Stripe-hosted pages and never reach Decret servers. Decret claims no PCI DSS certification of its own.

The edge applies security response headers, including a Content-Security-Policy, frame denial, and X-Content-Type-Options.

5. Authentication and sessions

• Authentication is by email and password, operated by Decret (not a third-party identity provider).
• Passwords are hashed with Argon2id using OWASP interactive parameters. Legacy hashes, if any, are rehashed on successful authentication.
• Sessions use a random token in an HttpOnly, SameSite=Lax cookie. An HMAC-SHA256 of the identifier is stored server-side. In production the cookie uses the __Host- prefix (Secure, Path=/, no Domain). Absolute lifetime is thirty (30) days. Idle timeout is fourteen (14) days (sliding).
• Successful login revokes other sessions. Password change revokes other sessions.
• Email-verification and password-reset tokens are hashed at rest, time-limited, and single-use.
• Cross-site request forgery controls include SameSite cookies and Origin checks on authentication POST requests.
• Rate limits apply per route and Internet Protocol address (Cloudflare connecting address where provided).
• A deployed instance fails closed if the authentication secret is unset.

6. Access control

Application programming interfaces that access a project require an authenticated user. Users who are not administrators may access only projects they own or were invited to, with the role granted (for example, view only). A link sent to an outside party works without an account, reaches only the requests for information or the draft it was made for, expires (thirty (30) days unless the project chose otherwise, ninety (90) at most), can be revoked at any time, and is rate limited. Its token is stored only as a salted hash. A link to a project’s shared folder reaches only the approved documents the project put in that folder, works for ninety (90) days from when it is sent or last extended, can be revoked at any time, is rate limited, and is checked again on every download; its token is likewise stored only as a salted hash. Email sent to a project address is accepted only through an authenticated internal endpoint; mail from senders who are neither members nor approved waits for the owner’s decision. Administrator accounts are designated and are not assigned to the first registration. Isolation is implemented in application logic.

Logo retrieval is authorised against the requesting user. File types and size limits are enforced on upload. Path traversal in logo filenames is rejected.

Customer-managed encryption keys, SSO/SAML, and SCIM are not offered.

7. Encryption

• In transit: TLS as configured at Cloudflare and on origin. Resend uses an authenticated HTTPS API. The database connection uses TLS.
• At rest: the database (Amazon RDS) and project files (Amazon S3) are encrypted at rest by the provider. Application-level encryption of project files is not implemented. This document makes no claim that the application host’s own disk, which holds the application, its logs, temporary files and the copy described in clause 13, is encrypted.
• Secrets: passwords and tokens are hashed as described above. Deployment secrets are held in AWS Systems Manager Parameter Store, in the Service’s AWS account, and written to the host at each deployment; they are not kept in source control.

8. Inference and Customer Content

AI features (drawing transcription, file classification, fact extraction, template filling, chat and the project assistant, site diary drafting, site photo descriptions, and measurement proposals) call a third-party model provider, Anthropic (Claude API), listed in Annex C to the Data Processing Agreement. Model output is checked against the project sources before it is shown, and a qualified person approves any document before issue.

When an AI feature runs:

• Customer Content, or extracts of it, may be transmitted to a model provider listed in Annex C to the Data Processing Agreement;
• Decret shall not use Customer Content to train models owned by Decret;
• under its commercial terms, Anthropic does not train models on that content and deletes it within thirty (30) days, unless it must keep it longer to enforce its usage policy or to comply with law; no zero-retention arrangement applies;
• Decret does not sell drawings or generated packs for use as training corpora by others.

9. Confidentiality

Decret shall not publish Customer packages. Operators may access a workspace to diagnose faults or to fulfil a support request, on a least-privilege basis. The Customer shall not upload material it is contractually forbidden to disclose to a software vendor.

10. Personnel

A limited number of operators can reach production systems. Access is intended to be least-privilege, with unique credentials. The production authentication secret is not shared as a general practice. Background checks and a formal security-training programme are not represented as certified current controls. Administrator functions in the product are limited to designated accounts.

Inbound email is routed to operators. Passwords and unnecessary personal data of workers should not be sent by email where the workspace can be used instead.

11. Vulnerability disclosure

Reports of security issues in decret.ai or the workspace shall be sent to hello@decret.ai with the subject “Security”, including sufficient information to reproduce the issue. A reasonable period shall be allowed for response before public disclosure. Decret does not operate a paid bug-bounty programme. Decret will not pursue researchers who report in good faith, follow this process, and refrain from data exfiltration, unsolicited messaging, or disruption.

There is no separate security mailbox: security reports go to the address above.

12. Logging

Authentication events (event type, user identifier, Internet Protocol address) are recorded without passwords or tokens. Application and host logs may include request metadata. A 24-hour security operations centre, SIEM, or third-party penetration-test programme with published dates is not claimed. Cloudflare and AWS provide infrastructure logs that may be used in an investigation.

13. Backup and retention

Automated backups of the database, with point-in-time recovery, expire after seven (7) days. Project files are kept in a versioned bucket, so an overwritten or deleted file can be recovered from an earlier version. No expiry is configured yet for earlier versions of project files kept by storage versioning, including versions of files that have since been deleted: they are retained until one is. The planned expiry is ninety (90) days, unless a legal hold applies. A copy of the Service’s data as it stood on 22 October 2026, kept from the move of the Service to its managed database, is held in the Service’s AWS account (on the application host and in its nightly backups) until the move is declared complete. Personal data that was in the Service on that date and was deleted later remains in that copy until the copy is deleted; no date has been set for that deletion. The procedure to restore the database to a point in time, into a new instance, is written down; no restore test is on record. This document makes no claim that backups are copied to a second region. The Customer should retain copies of issued documents outside the Service. Retention of personal data is described in the Privacy Policy. Deletion of Customer Data is described in the Data Processing Agreement.

14. Incidents

Decret shall notify affected customers of a personal data breach without undue delay, with a target of seventy-two (72) hours from becoming aware, as set out in the Data Processing Agreement. Continuous 24-hour incident response is not represented as a certified capability. If the Customer suspects an incident affecting its account, it shall write to hello@decret.ai and change its password.

15. Planned measures

Measures under consideration, without commitment as to order or date, include: deletion of the copy kept from the move to the managed database; an expiry for earlier versions of project files; documented backup and restore testing; and, if required by customers, a certification or readiness programme. None of the foregoing is a present certification.