Your inventions stay yours.
A patent application is confidential until it's published. Here is how Obsidyan keeps it that way.
Your applications are yours alone
Every table has row-level security in the database. Each query runs as the signed-in user, so the database itself decides which rows they can see, and one customer can't read another's patents.
Private files
Uploaded documents and drawings are stored privately. They aren't served from public links: each request is checked against your account, and only you can read or delete your files.
Encryption
Traffic to Obsidyan is encrypted with TLS. Your data is encrypted at rest by our infrastructure providers, Vercel and Neon.
Sign-in protection
Sign in with a password, or with Google or Microsoft through 1Profile. You can turn on two-factor authentication with any authenticator app, and repeated wrong codes lock the attempt. Passwords are stored as salted hashes, never in plain text.
API keys
Keys are stored as hashes and shown once. New keys are read-only by default, so a key can't change or delete anything unless you grant it write access. You can revoke a key at any time.
AI processing
AI features run through the Vercel AI Gateway, which only uses model providers with zero data retention agreements, and dictated answers are transcribed the same way. We don't use your inventions to train models. The support chat on our public pages is separate and runs on AngelSend, so please keep invention details out of it.
Certifications
We don't hold a SOC 2 report or ISO 27001 certificate yet. We'll list them here once an independent audit is complete. See who processes your data in our Privacy Policy.
Report a security issue
Email obsidyan@aw3.tech with the steps to reproduce it. Please give us time to fix it before you share it publicly.