Built for the vaults you cannot afford to expose
EnCad reads your engineering data; it never writes to it, never trains shared models on it, and never leaves the boundary you choose. SOC 2, ITAR-ready, and available on-prem.
Compliance and certifications
- SOC 2 Type II (state Type I/II and audit period; link to report request)
- ITAR-ready deployments for export-controlled data, with US-person-only support staff on request
- NIST 800-171 aligned controls; CMMC Level 2 readiness for defense supply chain customers
- GDPR-aligned data handling for EU customers
- Annual third-party penetration testing, with summary available under NDA
Deployment options
Managed cloud
Multi-tenant on managed cloud infrastructure with strict tenant isolation. Fastest to deploy. US and EU data residency available.
Customer VPC
EnCad runs inside your AWS, Azure or GCP account. Your data never leaves your cloud boundary; we manage the software, you own the environment.
On-premises
Fully air-gapped installation in your data center for classified programs and ITAR environments. Updates delivered as signed packages.
Encryption and key management
Data is encrypted in transit with TLS 1.2+ and at rest with AES-256. Keys are managed for you by default, or bring your own key (BYOK) through your KMS or HSM. Key rotation and revocation are under your control.
Access and identity
- SSO through SAML 2.0 and OIDC (Okta, Microsoft Entra ID, Ping)
- SCIM provisioning and deprovisioning
- Role-based access control that mirrors your existing permissions
- Full audit logging of searches, views and administrative actions, exportable to your SIEM
How EnCad handles your data
- Read-only. EnCad never writes to your systems.
- Your data is used only to serve your tenant. It is never used to train models shared with other customers.
- Geometry is processed into feature representations and embeddings; native CAD files are not retained in the cloud tier unless you choose to store them.
- Data deletion on request and at contract end, with certificate of destruction.
- Sub-processors listed and notified in advance of any change.
Operational security
Secure development lifecycle with code review and dependency scanning. Least-privilege infrastructure access. 24/7 monitoring with defined incident response and customer notification timelines. Business continuity and backup tested annually.
For your security team
We answer SIG, CAIQ and custom questionnaires, and support your vendor risk process from first call to signed DPA.
Contact security@getbild.com
Request the security packet
The security overview for your vendor risk review.