Security
How your files are handled.
Where Pack3D runs, what it keeps, for how long, and who else is involved. The privacy policy is the binding version of the same facts.
Your data
Where it lives.
- Hosting
- Our own server in Denmark, in the EU. Your files, results and account data are stored there.
- Uploads
- Deleted as soon as their job finishes. They are used to compute your layout and for nothing else.
- Results
- Kept in your job history until you delete them. Each account keeps its 50 most recent finished jobs; older ones are removed automatically.
- Backups
- Nightly, encrypted on our server before they leave it, and stored by Backblaze in the Netherlands, which does not hold the key. Each backup expires after about six months.
- Deleting
- You can delete a job, or your whole account, yourself at any time. Deletion removes it from the server at once, and from the backups as they expire.
Access
Who can reach it.
- Accounts
- Every job and result belongs to one account. Another account asking for it is told it does not exist.
- Passwords
- Stored only as salted Argon2 hashes. Sign-in attempts are rate limited, and changing your password signs out your other devices.
- Single sign-on
- Sign in with Google or Microsoft if you prefer. We receive an account identifier, never access to anything in that account.
- Sessions
- One HttpOnly, SameSite=Strict cookie. It expires after 24 hours at most, or 8 hours without use.
- In transit
- HTTPS only, with HSTS. Cloudflare terminates the connection and screens out automated abuse before a request reaches our server.
- In the browser
- A strict Content Security Policy: the site runs only its own code. No third-party scripts, no analytics services, no ads, no tracking cookies.
Paperwork
Who else is involved.
- Processors
- Four, named in the privacy policy: Cloudflare (network), Postmark (service email), Backblaze (encrypted backups) and Stripe (payments, which never see your files). The list is updated before a new one starts.
- DPA
- If you pack your own customers' models, you are the controller and we are your processor. A data processing agreement is available on request from privacy@pack3d.net.
- Breaches
- If a personal data breach affects you, we tell you without undue delay, and we notify Datatilsynet, the Danish Data Protection Agency, within 72 hours where the law requires it.
- Company
- Pack3D ApS, CVR 46787404, Brandsbjergvej 88, 2600 Glostrup, Denmark.
Found a problem?
Report a vulnerability.
- Where
- contact@pack3d.net, with enough detail to reproduce it.
- What we ask
- Test only with your own account, keep the service running for everyone, and give us a reasonable time to fix it before you publish.
- What you get
- A reply within a few business days, a fix as fast as we can make it, and credit if you want it.