Security
How your work is kept safe
The short version: your data is yours, you can export all of it at any time, and nothing is deleted unless you ask us to delete it.
Posture
What we do, in plain terms
Nothing is deleted by a storage limit
A full allowance pauses new uploads — everything you already made stays viewable, editable and exportable. Deletion only ever happens because you ask for it: closing your account starts a 30-day recoverable window before anything is removed for good.
Encrypted in transit; backups encrypted at rest
Traffic is served over HTTPS. Backups are encrypted before they leave our server — database dumps with AES-256, and drawing files encrypted client-side with their filenames obscured. The live server volume itself is not encrypted at rest; access to it is controlled by authentication and per-account ownership checks on every file request.
We never see your password or your card
Passwords are held by our authentication provider — we store only your email address and an internal id. No card details are stored anywhere, and no payment system is connected yet.
Your data is yours to take
A complete machine-readable export of everything you have made is available from your account at any time, free, including after a plan ends.
Sub-processors
Who we rely on
We use a small number of third parties to run the service — hosting, authentication, off-site backups and email. Ask us at info@costtakeoff.com for the current list.