In short
- Blake is in early access. In this phase we work with a limited number of companies, on an environment that Subduxion manages itself. That environment's storage is encrypted.
- Every record belongs to one organisation, and within a workspace roles set who can do what.
- The drawing reader is off until an owner or admin turns it on. When it is on, only crops of the drawing go to a compute provider in the EU.
- We do not yet have a certification, an SLA, a penetration-test report or a version on your own servers.
- Send a vulnerability, or a question for a security review, to security@useblake.ai.
Where is my data stored?#
Blake is in early access. In this phase we work with a limited number of companies, on an environment that Subduxion manages itself. That environment's storage is encrypted.
| What | Where |
|---|---|
| Requests, parts, calculations and quotes | In the environment Subduxion manages, with encrypted storage |
| Uploaded drawings and 3D models | In the same environment, in private storage, not at a public address |
| Crops for the drawing reader, only when it is on | A compute provider in the EU; that provider's administration and logs in the US |
The online service with fixed hosting locations will follow. When it goes live, we will update this page. The providers it will add are already on the Subprocessors page.
Who can see my drawings?#
Within Blake, only the people you give access. Every record belongs to one organisation, and Blake shows it only in that organisation's workspace. Subduxion manages the environment Blake runs on and can therefore reach your data for administration and support.
Within your workspace each user has a role: owner, admin, member or read-only. You choose who gets access and with which role.
Your drawings, 3D models, requests and workshop data remain yours. We use them only to provide Blake to you and treat them as confidential.
We do not use your drawings, 3D models or workshop data to train AI models, unless you give separate written consent.
How is data protected?#
The environment Blake runs on today has encrypted storage.
- Uploaded files are kept in private storage, not at a public address.
- Access is scoped per organisation and governed by role within the workspace.
- Crops for the drawing reader travel over an encrypted connection (TLS) to the compute provider.
During early access we do not offer a restore period, so always keep your own original files. For the online service we make backups of the database; we will state a fixed restore period only once restore has been tested in that environment.
What leaves the workspace?#
The drawing reader is off until an owner or admin of your workspace turns it on. When it is on, only crops of the drawing, never the whole file, go to a compute provider in the EU that runs a model we manage ourselves. That provider's administration and logs are in the United States. More on this is on the Your drawings and AI page.
During early access, no error reports or usage data go to an outside service.
You export quotes yourself as PDF, CSV or JSON. What you export, you then manage in your own systems.
What do we not offer yet?#
Subduxion does not currently hold a certification such as ISO 27001 or SOC 2. During early access we also do not offer:
- an SLA or an uptime percentage; we work to keep Blake well available, as the Terms of service describe;
- an independent penetration-test report;
- a version on your own servers (on-premise): Blake runs on the environment Subduxion manages.
What this page describes is what exists now. Send questions for a due-diligence or security review, or a security questionnaire, to security@useblake.ai.
Who does what?#
We look after the service; you look after who uses it and what goes into it. The table shows where the line is.
| Topic | Blake (Subduxion) | Your shop |
|---|---|---|
| Environment and subprocessors | Manages the environment Blake runs on and announces a new subprocessor 30 days ahead. | Can object to a new subprocessor. |
| Separation between organisations | Scopes all data per organisation. | No action needed. |
| Encryption | Encrypted storage in the environment Blake runs on. | Keeps the team's devices and browsers up to date. |
| Users and roles | Provides the roles owner, admin, member and read-only. | Decides who gets access, with which role, and removes people who leave. |
| Rights to files | Uses files only to provide Blake to you. | Makes sure it may upload its own customers' drawings and models, for example under their non-disclosure agreements. |
| Drawing reader | Is off until an owner or admin turns it on; sends only image crops of at most 2 MiB. | An owner or admin decides whether it is turned on. |
| Calculations and quotes | Blake prepares proposals and calculations. | Your people check, correct and confirm. You decide on prices and quotes and remain responsible for them. |
| Original files | Keeps what you upload in the workspace. | Keeps its own original files; during early access there is no restore period. |
| Exports | Delivers quotes as PDF, CSV or JSON. | Manages exported files in its own systems. |
| Incidents | Reports a personal data breach without undue delay and at the latest within 48 hours of discovery. | Reports suspicious use to security@useblake.ai. |
What if something goes wrong?#
If a personal data breach affects your workspace, we tell you without undue delay and at the latest within 48 hours of discovery. We tell you what happened, which data it affects, what we have done and what you can do.
You remain responsible for any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We give you the information you need for it.
If you notice something suspicious yourself, such as an unknown user in your workspace, report it right away to security@useblake.ai.
How do I report a vulnerability?#
Send your report to security@useblake.ai. The same address is in /.well-known/security.txt on this website.
Please include:
- what the vulnerability is and how we can reproduce it, step by step;
- what someone could do with it;
- how we can reach you.
We confirm receipt and keep you informed of what we do about it.
We ask you to:
- test only with an account and data that are yours;
- not view, change or keep data of other organisations;
- not disrupt the service, so no denial of service;
- not use social engineering or physical access;
- not disclose the vulnerability publicly before we have fixed it or agreed a moment together.
If you report in good faith and follow these terms, you need not expect legal action from us.