A diagram often carries more than it looks. An architecture sketch names your services, a schema shows how your data is shaped, an incident whiteboard captures things you would never want leaking out. So the honest question for any drawing tool is simple: where does this actually live, and who else can read it?
LetDraw is built so the default answer is "you". Your work starts and stays in your browser, the sensitive parts are encrypted before they ever leave your device, and when your requirements are strict you can run the whole thing on your own infrastructure. Here is how that works, without the marketing gloss.
Local-first by default
When you open a canvas, you are not signing away your data to start drawing. Diagrams work directly in the browser, including offline, and there is no third-party tracking following you around the app. Cloud sync is something you turn on, not something that happens to you.
- Works offline. The editor runs client-side, so you can keep drawing with no connection and nothing waiting to phone home.
- Sync is opt-in. Saving to the cloud and inviting collaborators are deliberate choices. Until you make them, your work stays local.
- No third-party tracking. The canvas is not wired up to ad networks or behavioural trackers watching what you draw.
The default is not "trust us with everything". The default is that your work stays with you until you decide otherwise.
Encrypted where it counts
When you do collaborate, the sensitive content is protected end to end. Live collaboration sessions and shared snapshots are encrypted right in the browser with AES-GCM, and the key is derived on your device. The relay that moves messages between participants only ever sees ciphertext. It shuttles bytes it cannot read.
Everything is protected in transit too. LetDraw uses TLS everywhere, with HSTS enforced for a full year, so browsers refuse to fall back to an unencrypted connection. On top of that, access to stored data is governed by row-level security in the database: you only reach your own data and the data of workspaces you belong to. Large scenes are not served from a public bucket either. They sit behind short-lived signed URLs that expire quickly.
Hardened at the edge
A drawing app is still a web app, and the browser is where most attacks land. LetDraw ships an enforced Content Security Policy together with a full set of security headers, so the app runs with a tight budget of what it is allowed to load and do. Imported SVGs are sanitized before they are ever placed on the canvas, so a crafted file cannot smuggle script into your session.
These are not aspirational. They are the headers the site actually returns:
# GET https://letdraw.com Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Content-Security-Policy: default-src 'self'; script-src 'self' X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), geolocation=()
In plain terms: connections are pinned to HTTPS for a year, scripts and other resources have to come from origins we explicitly allow, the app cannot be silently framed by another site, browsers are told not to guess content types, referrer data is trimmed on the way out, and hardware access like the camera and geolocation is switched off. You can read the fuller picture on the security page.
Self-host when nothing else will do
Some data simply should not leave the building, and no amount of encryption on someone else's servers changes that policy. For those cases, Enterprise plans can self-host LetDraw, so the app and its data run entirely inside your own network or region. Nothing leaves your infrastructure, and data residency stops being a promise you have to take on faith and becomes a fact of your own deployment.
Self-hosting is also the cleanest answer to the strictest compliance requirements, because it puts the whole system under controls you already run and audit yourself.
An honest word on compliance
We would rather be straight with you than pad a page. LetDraw is not yet formally certified against schemes like SOC 2 or ISO 27001. What we can do today is share how the system is built, walk through a security questionnaire, and put a data processing agreement in place. If your team needs a DPA or has a questionnaire to run, contact us and we will work through it. And if your requirements go beyond what any hosted tool can promise, self-hosting keeps every byte on your side of the fence.
Security is not a badge you earn once and hang on the wall. It is a set of defaults. Local-first so your work is yours to begin with, encryption so the sensitive parts stay unreadable to anyone in the middle, hardened headers so the browser stays honest, and self-hosting for when the answer has to be "on our own machines". That is the shape of a diagram tool you can actually trust with the real stuff.