Security
What stays on your computer, what we store, what the assistant sees, and how the engines that run your design are checked.
On your computer
- Simulation and builds
- Compiling, simulating, synthesis, place and route, bitstreams and flashing all run in your browser tab. None of them sends your source anywhere.
- Projects
- Projects are kept in your browser first, so they open instantly and work offline. Signed out, they never leave this computer.
- Isolation
- The workspace runs cross-origin isolated, so other sites cannot read its memory, and the simulator runs in its own worker.
The engines
- Pinned files
- The 75 engine files, across six packages, each have a pinned size and SHA-256. A download that does not match is rejected before it runs, so a compromised or stale mirror cannot change what executes.
- Reproducible builds
- Each build records its sources, scripts, seed, tool versions and engine digests. The same inputs give the same bitstream.
What we store
- Saved projects
- Signed in, projects are saved to your account. Postgres row-level security decides who can read or change each one: the owner, and the people it is shared with.
- Share links
- A link carries a random token. Opening it asks the person to sign in, then a server-side check adds them to the project at the link's role, view or edit.
- Keys
- Database, model and payment keys stay on the server. Every connection uses HTTPS, and stored data is encrypted at rest by our providers.
The assistant
- What it sees
- Your messages, a brief of the project (file names, modules, tests, diagnostics and the last run's results), and the file contents and waveform values its tools read during that conversation.
- Where it goes
- Requests go through RTL++'s server to Azure OpenAI under Microsoft's enterprise terms, the same path Spice++ uses. Azure states it does not train its base models on these requests.
- Spend limits
- Each request is charged against your allowance on the server before the model runs, so no browser can exceed it.
The processors we use and how long we keep data are in the privacy policy. To report a vulnerability, write to contact@surfplatforms.com.