Privacy policy

Last updated 18 October 2026.

ApexDiagram is in beta. Beta status does not lower how we protect your data: everything in this policy applies in full. What changes faster during the beta is the product itself, so this policy may be updated more often; see Changes below.

Who we are

ApexDiagram is the data controller for account data and the data processor for the network documentation you store. Contact: security@apexdiagram.com.

What we collect

• Account data: your email address, display name and a salted hash of your password. We never store the password itself.
• Organisation data: organisation name, plan, and the roles of its members.
• Diagram data: everything you put in a diagram: device names, hostnames, IP addresses, serial numbers, asset tags, locations, cables, documentation text, attachments and uploaded symbols. This can include personal data if you enter it (for example a workstation named after a person). You decide what goes in.
• Audit trail: who changed what and when, including changes made through API keys. This is part of the product and is visible to every member of the organisation.
• Session data: a signed session cookie so you stay logged in. We do not use tracking cookies or third-party analytics on the application.
• Feedback: if you use the Feedback button, the text you write, the optional mood you pick, the app page you sent it from (the path only, such as /diagrams/…/network, not the diagram’s contents) and your account. It is read by the ApexDiagram team to improve the product, and we may email you about it.
• Support tickets: the messages you and our support staff exchange, with your account and organisation, so we can answer and keep the thread.
• Mailing list: if you join it from the home page, your email address and the date. We use it only to send occasional product news, never share it, and remove it when you ask.
• Server logs: request logs with IP address and user agent, kept for 30 days for security and debugging.

How we use it

To provide the service: rendering your diagrams, enforcing roles and plan limits, keeping version history and the audit trail, and sending transactional email such as password resets. We do not sell data and do not use your diagrams to train models.

Where your data is stored

The service runs on a single virtual server with Oracle Cloud Infrastructure in Ashburn, Virginia, United States. Your account data, diagrams, attachments and audit trail are stored in PostgreSQL there, and nightly backups are made there. Encrypted copies of those backups are kept with Cloudflare R2 in a separate account; the backup key never leaves our systems, so the copies are unreadable on their own. Identifying diagram fields (hostnames, addresses, serial numbers, descriptions, documentation, attachments and version snapshots) are encrypted with a key specific to your organisation before they reach the database. We do not process your data in any other region. If you need your data held in a particular country, ask before signing up; we will tell you plainly whether we can do it yet.

Third parties that may receive data

We use a small number of providers to run the service. Each receives only what is listed, over encrypted connections, and under terms that forbid using it for anything else.

• Hosting and database: Oracle Cloud Infrastructure, as described above.
• Backups: Cloudflare R2 holds encrypted backup copies only.
• Email: Resend sends our transactional mail (password resets, verification, invitations) and product news, and receives the recipient address and the message.
• Payments: Stripe handles checkout, subscriptions and invoices. Your card details are entered on Stripe’s own pages and never reach us; Stripe receives your email, name and billing address.
• AI architect (optional): when you use the architect, a summary of the current diagram (device names, types, addresses, cables) and your message are sent to Anthropic to generate the response. Anthropic’s API terms apply and do not permit training on that data. Do not use the architect on diagrams you cannot share with a processor.
• Sign in with Google (optional): if you choose it, Google tells us your email address, name and account identifier; nothing else is shared.
• Password safety check: when you set a password, the first five characters of a hash of it are sent to Have I Been Pwned to check whether it appears in known breaches. The password itself, and your identity, are never sent.
• Bot protection: the sign-up, sign-in and password-reset pages use Cloudflare Turnstile, which checks the browser (not who you are) to keep automated sign-ups out. Cloudflare receives your IP address and browser signals for that check only.
• NetBox import (optional): the NetBox URL and token you enter are used for that request only and are not stored.
• Monitoring: request timings, error reports and server log lines are sent to New Relic to keep the service reliable. Logs are redacted before they leave the server: no passwords, tokens, cookies, request bodies or diagram contents are included; errors carry the route pattern, not the full address.

If we add or replace one of these providers, or move your data to another region, we will email organisation owners at least 30 days beforehand and update this page. You can export and delete your organisation before the change takes effect.

Share links

A share link makes one diagram readable by anyone holding the link, without an account. Links can be given an expiry and revoked at any time from the diagram menu. Treat them like a password to that diagram.

Retention

Diagrams, versions, attachments and the audit trail are kept while the organisation exists. Deleting a diagram deletes its versions, attachments, share links and drafts. Deleting an organisation deletes everything in it. Backups are kept for 30 days on our server and encrypted copies for 90 days off-site, then deleted; deleted diagrams sit in a 30-day trash first. Feedback is kept for up to 12 months after the beta ends; if you delete your account, your feedback stays but is no longer linked to you, and your support tickets are deleted. You can export any diagram as JSON or YAML at any time.

Your rights

Depending on where you live you may have rights to access, correct, export, restrict or delete your personal data, and to complain to a supervisory authority. Write to info@apexdiagram.com and we will respond within 30 days. Owners can delete their organisation from Settings.

Security

Passwords are hashed with bcrypt, API keys are stored only as SHA-256 hashes, all traffic is over TLS, and every database query is scoped to your organisation. Uploaded SVG symbols are sanitised before display. Report security issues to security@apexdiagram.com.

Children

The service is not directed at children under 16 and we do not knowingly collect their data. Student use is expected to be through an institution or with a guardian.

Changes

We will post changes here and update the date above. Material changes will be announced in the app or by email.