Security
Security at Resin
Your schematics, boards, and libraries represent years of engineering. This page sets out how Resin protects them: how you sign in, who can open a project, what leaves our systems and why, and how to report a problem.
Your designs never train AI
Resin does not train models on your projects, chats, or libraries. Anthropic and OpenAI run Resin AI; Gemini may read a datasheet and the question asked about it.
You decide who gets in
Only your workspace and the people it invites can open a project, and every staff access is logged.
Take everything with you
Every project exports in full, as KiCad or Altium files and manufacturing outputs, on every plan.
AI and your designs
Resin AI sends a model only what it needs to answer the request in front of it, and Resin does not use what it sends to train a model.
- Model training
- Resin does not train models on your projects, chats, or libraries. Resin AI requests go to Anthropic or OpenAI, and Google's Gemini may read a datasheet and the question asked about it.
- What is sent
- Your message and the parts of the open project needed to answer it, per request. Nothing is sent until you use an AI feature.
- Provider storage
- OpenAI requests are sent with response storage turned off.
- Datasheets
- When Resin reads a datasheet or generates a symbol from one, the datasheet (including one at a link you provide), the part number, and the question asked about it may be read by an AI model (Gemini) to extract pinouts, package drawings, and the requested facts. Your project files are not sent.
- Your control
- Every AI change is an ordinary edit in version history that you can review, reject, or undo.
Accounts and sign-in
The same sign-in protections apply to every account on every plan.
- Passwords
- Stored only as salted bcrypt hashes, with minimum length and complexity rules.
- Two-factor
- TOTP with any authenticator app. Secrets are stored encrypted, and single-use backup codes are stored as hashes.
- Google sign-in
- Google ID tokens are verified against Google's signing keys, and the Google account's email must be verified.
- Email verification
- New accounts confirm their email address before the first sign-in.
- Sessions
- Short-lived access tokens, renewed through an HttpOnly, Secure cookie that is replaced on every use. Replaying an old refresh token ends every session on the account.
- Password changes
- Changing or resetting a password signs out every other session.
- Throttling
- Sign-in, signup, and recovery are rate limited per account and per IP address, and every sign-in attempt is recorded.
Workspace access
A project is visible only to its workspace and the people that workspace invites. Access is checked on every request, not just at sign-in.
- Roles
- Admin, Lead, Designer, and Viewer. Viewers can read, comment, and export. Designers, Leads, and Admins can edit.
- Membership
- Admins and Leads manage members, and only Admins can grant Admin or Lead. Billing is limited to Admins.
- Guests
- Guest access can be given an end date.
- Share links
- Expire by default, can be revoked at any time, and are stored only as hashes.
- Isolation
- Every project request passes through one central authorization check scoped to your workspace.
- Resin staff
- Resin engineers can open workspace data to provide support and operate the service. Every access is written to an append-only audit log that cannot be edited, and is kept for seven years.
Your data
Your designs are never locked in. You can take everything with you at any time, on any plan.
- Where it lives
- Project files and their version history are stored in a managed database in the United States.
- Version history
- Every project keeps a history of saved revisions that you can compare and restore.
- Export
- Any project, in full: KiCad and Altium files, Gerber, drill, ODB++, IPC-2581, STEP, pick-and-place, and BOM.
- After a plan ends
- Projects stay available to view and export. Nothing is deleted because a subscription lapsed.
- Leaving
- Deleting an organization archives its workspace for a 30-day grace period, during which the organization's owner can restore it. After that, Resin permanently erases the workspace's projects, files, repositories, library content, conversations with Resin AI, and generated artifacts. Closing your account removes your identity (your name, email address, and sign-in details) and, if you choose, erases the workspaces you solely own in the same way; projects in workspaces you share stay with your teammates. A record that the deletion happened is kept in the audit log, and backup copies expire within 89 days.
- Backups
- Our hosting provider takes daily database snapshots kept for 6 days, weekly snapshots kept for 27 days, and monthly snapshots kept for 89 days, so every backup copy expires within 89 days. We are establishing regular restore tests; results are available on request.
Application and infrastructure
Resin is hosted in the United States, with the application, API, and database in one region. Every connection to them is encrypted.
- In transit
- HTTPS on every connection, enforced with HSTS.
- Browser protections
- A CSRF check on every state-changing request, a CORS allow-list, and headers that block framing by other sites and content-type sniffing.
- Rate limits
- Exports, fabrication outputs, share links, and AI endpoints are limited per user, per workspace, and per IP address.
- File imports
- Uploads are size-limited, archives are checked for path traversal and decompression bombs, and converters run in isolated processes with time and memory limits.
- Scripts
- Board scripts run in a sandboxed worker in your browser with network access removed, and are stopped when they exceed their time limit.
- Analytics
- No third-party analytics or advertising scripts on the site or in the app. Product analytics stay in Resin's own databases hosted on Railway (PostgreSQL and ClickHouse).
- Releases
- A production build can only be produced after the automated test suite passes. A documented break-glass exists for emergencies: production refuses a build made with it unless a release manager has allowed that one release for at most two hours, and every use is recorded in the deploy log.
Service providers
Resin uses a small number of third parties to run the service. Each receives only the data its job needs. This list is kept current on our security page at resineda.com/security. We announce changes by email to workspace Admins 30 days before a new provider starts receiving data.
| Category | Purpose | Data it receives | Providers |
|---|---|---|---|
| Cloud hosting | Runs the application, API, PostgreSQL database, and ClickHouse analytics store in the United States. Where it is configured, object storage may hold the manufacturing packages you generate and database backups. | Account and project data, product analytics events, and, in object storage, manufacturing packages and database backups | Railway; S3-compatible object storage |
| AI model providers | Answer Resin AI requests. Gemini may read a component datasheet when Resin reads a datasheet or generates a symbol from one. | Your messages, the design content needed to answer, and datasheet pages. Gemini receives the datasheet, the part number, and the question asked about it. OpenAI requests are sent with storage disabled. | Anthropic, OpenAI, Google (Gemini) |
| Payments | Subscription billing and invoices, through a PCI DSS Level 1 processor | Name, email, billing address, and a tokenized payment method | Stripe |
| Email delivery | Verification, invitation, receipt, and security emails | Your email address and the message sent to you | Resend |
| Sign in with Google | Optional sign-in | Your Google account email and profile, only if you choose it | |
| Parts data | Part search, pricing, availability, and datasheet lookup. Public datasheets are downloaded from the manufacturer or distributor that publishes them, such as Mouser; no Mouser service receives your searches. | Part numbers and search terms only. Never project files. | DigiKey, JLCPCB, LCSC (including its EasyEDA part service), Octopart (Nexar), SamacSys, You.com |
| Password safety | Checks a new password against passwords exposed in known data breaches | The first five characters of the password's SHA-1 hash only. Never the password or your email address. | Have I Been Pwned (Pwned Passwords) |
| Team notifications | Tells the Resin team when an account is created, and alerts the on-call engineer when a production check fails | Name, email, and workspace name of each new sign-up; operations alerts carry internal identifiers only | Slack |
| Error monitoring (being added) | Will record application errors so we can fix them. It starts receiving data only after the 30-day notice below. | Error reports and stack traces, scrubbed of passwords, tokens, cookies, and IP addresses | Sentry |
Reporting a vulnerability
If you believe you have found a security issue in Resin, please tell us privately first. We read every report, and we would rather hear about a problem from you than find it later.
hello@resineda.comInclude the affected URL or feature, steps to reproduce, and what an attacker could do.
Email a reportWhat to expect
- A reply from an engineer confirming we have your report, within 2 business days.
- Updates while we investigate, and a note when the fix ships.
- Credit for the finding if you would like it.
Good-faith research
We will not pursue or support legal action against research that follows these guidelines:
- Test only against accounts and workspaces you own or have permission to use.
- Do not access, change, or keep other customers' data. Stop and report as soon as you see any.
- No denial-of-service, spam, social engineering, or physical attacks.
- Give us reasonable time to fix the issue before disclosing it publicly.
Trust and audits
Where Resin stands on independent audits today, and the published commitments that back this page.
- SOC 2
- SOC 2 readiness covering Security and Confidentiality is in progress as of October 2026. No SOC 2 report has been issued; if one is, it will be available under NDA on request.
- Penetration testing
- No third-party penetration test has been performed yet.
- ISO 27001
- Not planned.
- Sub-processors
- Every provider is named in the service providers table above. This list is kept current on our security page at resineda.com/security. We announce changes by email to workspace Admins 30 days before a new provider starts receiving data.
- Backups
- Our hosting provider takes daily database snapshots kept for 6 days, weekly snapshots kept for 27 days, and monthly snapshots kept for 89 days, so every backup copy expires within 89 days. We are establishing regular restore tests; results are available on request.
- Vulnerability reports
- Email hello@resineda.com. We aim to acknowledge every report within 2 business days. The same policy is published at resineda.com/.well-known/security.txt and in the disclosure section of this page (resineda.com/security#disclosure).
Security reviews
Evaluating Resin for your company? Send us your security questionnaire and we will complete it, walk your team through how Resin handles your data, and answer procurement questions directly. Enterprise agreements can include contractual security and data-handling terms.