Security and data handling
What happens to your models, drawings and credentials in each way of using Occlusia, as the service runs today — for the teams that need to assess it.
Three ways to use Occlusia, three paths for your model
Studio draws on your computer; the REST API and MCP draw on Occlusia’s servers.
- Occlusia Studio, in your browser
- Your models are opened, drawn and saved in your browser, on your own computer, and are not stored on Occlusia’s servers. They reach those servers in three cases only: a DXF or PDF export, whose drawing is converted and returned, then not kept; a live link with Occlusia Link, whose model passes through Occlusia’s relay to your open tab; and Auto config, which receives only your objects’ and groups’ names and never stores or logs them. A recovery copy of an unsaved project stays in your browser’s storage.
- REST API, on Occlusia’s servers
- A model you upload is opened, drawn and exported by Occlusia’s engine on Occlusia’s servers, in a session of its own. Its files stay in that session while it lives — until you end it, after 15 minutes unused, or after 8 hours at most — and are deleted with it.
- MCP, on Occlusia’s servers, through your AI tool
- Occlusia’s MCP server is remote only: it runs beside the REST API, at api.occlusia.app/v1/mcp. The AI tool you connect works in a workspace — one engine session per key or connected app — which ends after 15 minutes unused, its files with it. What the AI tool itself keeps of your conversation and of the files it sees is governed by its own provider.
Every session in an engine of its own
A model file can be malformed, or made to be: it must never reach another session, the account service or the network.
- Its own process and user
- Each session runs its own engine, as a system user of its own, without privileges, with bounded memory, processor time, files and processes.
- No network
- An engine reaches nothing but Occlusia’s own conversion and account services, through a relay on the same machine: no internet, no database, no other session.
- Its own files
- A session’s files are reached only by its engine and the API gateway. File names are checked, links are never followed, and the files are deleted when the session ends.
- Public links only
- A file fetched from a web address comes from the public internet only, every redirect checked, never from a private network.
API keys and connected apps
Two ways for a program to act for your account, both under your control.
- API keys
- Made with a sign-in from the last few minutes, shown once, then kept by Occlusia only as a one-way fingerprint, with their last four characters. Each has an expiry; revoking one stops every program using it at once. Occlusia emails you each time a key is made.
- OAuth 2.1
- An AI tool or an app connects through the authorization code flow with PKCE. The consent page on occlusia.app shows the app’s verified identity when it has one, and where it will send you back. Its tokens are kept only as fingerprints; an access token lasts an hour, and refresh tokens change at every use.
- What an app can do
- Only what you allowed: use the engine with your credits, read your account. It can never change your password, your sessions or your keys, pay for anything, or delete your account. Disconnecting it under Connected apps stops it at once.
How your account is protected
- Passwords
- Hashed with Argon2id, never stored or sent in readable form.
- Sessions
- Credentials are held in httpOnly, Secure, SameSite cookies that no script can read, and the sign-in credential is replaced every time it is used.
- Abuse
- Sign-in and registration are rate-limited by email address and by IP address, and protected by a security check.
- Infrastructure
- The database cannot be reached from the internet: only the account service talks to it. All traffic between your browser and Occlusia runs over HTTPS.
Where it runs, and who else handles data
Occlusia’s servers — the website, the web app, the account service, the API and its engines, the database and its backups — are hosted by Hetzner, in the European Union, in Finland.
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts Occlusia's servers: the website, the application, the account service, its database and its backups | European Union (Finland) |
| Amazon Web Services EMEA SARL (Amazon SES) | Sends the account service's emails, such as verification codes | European Union (Sweden) |
| Cloudflare, Inc. | Domain names; the security check; routing of emails sent to occlusia.app addresses; hosting of Occlusia's extension repository for Blender | Worldwide network, including the United States |
| Microsoft (Outlook.com) | The mailbox where emails sent to Occlusia are received and answered | European Union and United States |
| Stripe Payments Europe, Ltd. | Takes payments on its own page, and issues invoices and receipts | European Union (Ireland), and the United States |
What each provider receives, and on what terms: the Privacy Policy.
How long anything is kept
- API files
- Deleted with their session: when you end it, after 15 minutes unused, or after 8 hours at most.
- DXF and PDF conversions
- The drawing sent for conversion is not kept once the file is returned.
- A deleted account
- Deactivated at once, every session ended, then erased 30 days later.
- Backups
- The database is backed up every night, and each backup is kept 14 days: erased data leaves the backups within that time.
- Logs
- Technical logs are kept in a buffer of limited size, overwritten as new requests arrive.
- Keys and apps
- A revoked key or a disconnected app stops at once; its record is deleted 90 days later, or with your account.
What this page does not claim
This page describes how the service is built; it is not a certification. Occlusia holds no security certification such as ISO 27001 or SOC 2, and its standard terms include no service-level agreement. An agreement can address security requirements, support and service levels: see Enterprise and OEM.
Security questions, or a vulnerability to report: write to hello@occlusia.app. The Privacy Policy, the Cookie Policy and the Terms of Service give the full detail.