Your diagrams stay yours.
LetDraw is built local-first and encrypted by design. Your drawings live in your browser, sensitive data is encrypted end to end, and you can self-host to keep everything on your own infrastructure.
Security you can actually verify
No black box. Here is what protects your work, from the browser to the database.
End-to-end encryption
Live collaboration and shared snapshots are encrypted in your browser with AES-GCM. The relay only sees ciphertext.
Encrypted in transit
Every request runs over TLS with HSTS enforced, so connections can never quietly fall back to plain HTTP.
Row-level access control
The database enforces who can read each row. You only ever reach your own documents and your workspace's data.
Hardened by default
A strict Content Security Policy plus a full set of security headers shut down XSS, clickjacking and MIME sniffing.
Local-first & private
Drawings work in your browser and offline, with no third-party tracking. Cloud sync is opt-in, not on by default.
Self-hostable
Run LetDraw on your own servers on Enterprise. Your data never has to leave your network or region.
Encrypted where it matters
Encryption is applied in the browser before data leaves your device, so the parts that carry your ideas stay unreadable to anyone in the middle, including our own infrastructure.
- In transit: TLS everywhere, HSTS for a full year
- End to end: collaboration and shared snapshots use AES-GCM, keyed in the browser
- At rest: your own AI keys are stored encrypted, large scenes behind short-lived signed URLs
- Your keys, your choice: guest and free AI keys never leave your device
// encrypted in the browser, before it is sent crypto.subtle.encrypt( { name: "AES-GCM", iv }, roomKey, // derived on your device scenePayload ) // the relay only ever forwards ciphertext
Locked down at the edge
Every response is served with a strict security header set and an enforced Content Security Policy. Scripts can only load from us, connections are pinned, and the app cannot be framed by another site.
- Enforced CSP, no inline scripts, connections pinned
- Imported SVGs are sanitized before they touch the canvas
- Camera, microphone and geolocation are off unless you ask
Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: default-src 'self'; script-src 'self' … X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(self), geolocation=()
You decide what leaves your device
LetDraw collects as little as possible and gives you control over the rest.
Data minimization
We store what is needed to run your account and no more. No third-party analytics selling your behaviour.
Export and delete
Your drawings are yours to export any time (PNG, SVG, PDF or code) and to delete when you are done.
Data residency
Self-host on Enterprise to keep every diagram inside your own network, region and compliance boundary.
Access, managed the way IT expects
For organisations, LetDraw plugs into your identity stack so joining and leaving is automatic and access is centrally controlled.
- Single sign-on (SSO) with your identity provider
- SCIM provisioning for users and groups
- Automatic domain join and workspace roles (owner / editor / viewer)
- Email verification on sign-up, revocable API tokens with scopes
Payments handled off our servers
Subscriptions run through Paddle as Merchant of Record. LetDraw never sees or stores your card details, and every receipt links straight to Paddle to manage or cancel.
Found something? Tell us.
We take security reports seriously and will work with you in good faith.
Report a vulnerability
Email contact@letdraw.com with "Security" in the subject. Please include steps to reproduce and give us reasonable time to fix the issue before disclosing it publicly. We will keep you updated and credit you if you would like.
Straight answers
Where we stand
We build to the practices that formal audits check for: encryption, least-privilege access and data minimization, and we align with GDPR principles. We are not yet formally SOC 2 or ISO 27001 certified. If your organisation needs a specific certification, a Data Processing Agreement, or a security questionnaire completed, contact us at contact@letdraw.com and we will work with you. For the strictest requirements, self-hosting keeps everything inside your own boundary.
Security you can read, not just trust.
Start free in your browser, keep your data local, and upgrade to self-hosting when you need full control.