Glossi holds your 3D models, renders, and product data. This page describes how that data is stored, protected, and accessed, and how we operate the platform. Questions go to contact@glossi.io.
Infrastructure and data location
Glossi runs on managed cloud providers and operates no self-managed network infrastructure. Customer data is stored in the AWS us-east-2 (Ohio) region.
- Application. The web application is hosted on Vercel; the API runs in containers on Render.
- Database. MongoDB Atlas, hosted in AWS us-east-2.
- Files. Uploaded models, renders, and generated textures are stored in AWS S3 in us-east-2 and delivered through AWS CloudFront using signed cookies, so only authorized users can fetch a workspace's assets.
- Rendering. The live Studio runs on GPU instances in three AWS regions (US East, US West, and EU Central) for low-latency streaming. These instances handle transient work only and persist no customer data; each one is provisioned for a session and terminated afterwards.
Encryption
- In transit. All traffic between users and Glossi uses HTTPS with TLS 1.2 or higher. No HTTP-only endpoint is exposed in any environment. Internal service connections, including to the database, identity provider, and payment processor, also use TLS.
- At rest. The database, object storage, and the disks attached to rendering instances are encrypted at rest by the underlying cloud providers. Application secrets are stored in Doppler, encrypted at rest and in transit.
Access and authentication
- Customer accounts. Sign-in is handled by Auth0 using OAuth 2.0 and OpenID Connect. Glossi never stores user passwords. Users can enable multi-factor authentication on their account.
- API access. REST API keys are hashed before storage and can be named, expired, and revoked from workspace settings. Webhook payloads are signed with HMAC-SHA256.
- Workspace restrictions. Workspace owners can restrict access by country and by IP range. Every request outside the allow-list is refused, for both the application and the API.
- Tenant isolation. Every workspace is a separate tenant. Data access in the application is scoped to the tenant on every query.
- Personnel. Multi-factor authentication is enforced for staff on every system involved in operating the platform. Production access is limited to the engineering team and removed when someone leaves, with shared secrets rotated.
Application security
- All changes ship through pull requests on protected branches with automated checks: type checking, tests, linting, tenant-scoping checks, a production dependency audit, and secret scanning on every pull request.
- Dependabot monitors every repository and opens updates for vulnerable dependencies.
- Separate development, staging, and production environments. Changes reach production only through the same review and check process.
- Uploaded files are processed in isolated conversion services; the rendering fleet is rebuilt from versioned images, so no instance runs stale software beyond a single session.
Monitoring and incident response
Datadog collects application metrics, traces, and logs, and alerts engineering when thresholds are breached. Sentry reports application errors. Infrastructure signals come from AWS CloudWatch. Engineering coverage spans Berlin and the US West Coast.
Incidents are triaged by severity. Customers affected by an incident are contacted directly, by email and through in-product messaging.
Vulnerability management
Vulnerabilities are found through Dependabot, secret scanning on every pull request, a production dependency audit in CI, and the managed scanning our cloud providers run on their infrastructure. Findings are prioritized and tracked to remediation.
Your data
- Models, renders, and derived files are deleted from storage when you delete the corresponding record.
- You can delete your account, and its data, from the account page in the application.
- Requests to access, correct, or export personal data can be sent to contact@glossi.io. See the Privacy Policy for what we collect and why.
Sub-processors
The services that participate in operating the platform: Amazon Web Services (storage, rendering, queues, CDN), Vercel (web hosting), Render (API hosting), MongoDB Atlas (database), Auth0 (authentication), Stripe (payments), Doppler (secrets), Datadog and Sentry (monitoring), and Intercom (customer messaging). Each is covered by the provider's own security program and service terms.
Reporting a security issue
If you believe you have found a vulnerability in Glossi, email contact@glossi.io with the details. We will acknowledge the report and keep you informed while we investigate.