Data Security & AI Overview
OpusAg Ltd · July 2026 · The one-page answer to "where does our data go?"
In one paragraph: DraftX runs on your machines and your network. Your CAD models, drawings and job files stay on your servers — OpusAg holds no copy of any of it. The AI sorting step sends a rendered image of each drawing, in memory only, through our broker to AWS's London data centre for classification and back; nothing is stored, logged, or used to train models anywhere along that path. The only data OpusAg keeps is what's needed to run your licence: contact details, licence keys, machine fingerprints and usage counts.
1. Where your engineering data lives
- CAD models, drawings, PDFs, DXFs, job folders: your machines and your network shares. DraftX reads and writes them locally; they are never uploaded to OpusAg.
- Job records and operator names: stored in the analytics files inside your own job folders, on your server, under your control.
- Customer names, pricing, commercial data: never transmitted. DraftX has no telemetry that reads file contents.
2. How the AI drawing sorting works
The AI sort classifies each drawing (assembly, sheet-metal part, machined part, etc.) so packs collate themselves. The data path is deliberately narrow:
| Step | What moves | Where |
|---|
| 1. Your PC → OpusAg broker | Rendered drawing image + filename + OCR text, over TLS | OpusAg licence server (in-memory pass-through) |
| 2. Broker → AWS Bedrock | Same payload, forwarded unchanged | AWS London region (eu-west-2), EU inference profile |
| 3. Bedrock → your PC | The classification answer | Returned through the broker, unmodified |
- Nothing is stored. The broker keeps the request in memory for the duration of the call only. We record token counts per job for quota — never images, text, or answers.
- Nothing is trained on. AWS Bedrock does not retain prompts or completions and does not use them to train models, under AWS's service terms.
- UK/EU residency. Inference stays within UK/EU AWS regions via an EU cross-region inference profile.
- No keys on your machines. Your PCs hold no AI credentials; access is authenticated by your DraftX licence and revocable per machine.
- Optional. The feature can be disabled; DraftX falls back to non-AI sorting.
3. What OpusAg holds about you
| Data | Why |
|---|
| Contact name, business email, company name | Issuing and administering your licence or trial |
| Licence key, type, expiry | Licence administration |
| Machine fingerprint (one-way hash) and machine name | Per-machine licensing; the hash cannot be reversed into hardware details |
| Validation logs and AI usage counts (token totals per job) | Security, support, and quota |
That's the complete list. Full detail, retention periods, and your UK GDPR rights are in the privacy policy.
4. Application security
- Code-signed Windows installer with automatic updates delivered over HTTPS from GitHub Releases.
- All traffic encrypted in transit (HTTPS/TLS) — licence checks, AI calls, updates.
- Licences are cryptographically signed (Ed25519) and bound per machine; the server can revoke any machine remotely.
- No inbound connections: DraftX only makes outbound calls to the licence server and update host. Nothing on your network is exposed.
5. Working with PDM / vault systems
DraftX works alongside PDM (SOLIDWORKS PDM, Autodesk Vault, and similar). It requires no PDM integration because it never competes with the vault for control of your files:
- DraftX never checks out, moves or deletes CAD files, and its batch operations never modify them. Exports open parts and drawings read-only and silently; the only files DraftX writes are its own outputs — PDFs, DXFs, job packs — into your job folder. The one save DraftX ever performs is in Drawing Review's Update step, where it saves the edits your engineer just made to the open drawing (the same as them pressing Ctrl+S) — under PDM that drawing is already checked out to them, exactly as your vault rules require.
- You open the assembly exactly as you do today — through your PDM client and local vault view. DraftX reads from the live SolidWorks session, so whatever check-out or get-latest rules your vault enforces are already satisfied before DraftX is involved.
- Read-only files are fine. If a file is checked out to someone else, SolidWorks opens it read-only and every DraftX operation still works — nothing DraftX does needs write access to design data.
- One practical requirement: vault files must be cached locally (a normal "Get Latest Version"). If DraftX finds an un-fetched placeholder file it stops with a clear message telling the user to get the latest version and re-run, rather than exporting stale data.
6. Questions
If your IT or compliance team wants more depth — sub-processor list, data-flow diagrams, or contractual terms — email sales@opusag.co.uk and we'll walk them through it.