Security & Data Handling
Last updated 19 August 2026. You are uploading confidential product design information. These are the specific measures in place today — stated factually, with no certification claims we have not earned. PartOptix is operated by Neat Labs LLC.
Your BOMs stay private to your account
Uploaded BOM lines, quantities, reference designators, project names and notes are stored against your user account and protected by database row-level security policies scoped to your user id. Other customers cannot query them.
Encryption in transit and at rest
Production traffic is served over HTTPS/TLS. The managed Postgres database and its backups are encrypted at rest by the hosting provider.
Authentication and access controls
Access requires an authenticated session. Application routes that read or write customer data are gated server-side, and privileged administrative capabilities are restricted by a separate role table rather than client-side flags.
Shared component intelligence is separated from your data
Normalized manufacturer part identities, public specification data and distributor offers are stored in shared reference tables. They contain no customer-identifying information, and deleting your project never removes shared component records other users depend on.
Card data never reaches PartOptix
Payments are processed and sold through Paddle as Merchant of Record. PartOptix does not directly store or process complete payment-card details.
Supplier credentials are server-side only
Distributor API credentials are read inside server handlers. They are never shipped in browser JavaScript, returned in API responses or included in error messages.
Server-enforced quotas and structured logging
Plan limits and metered usage are enforced server-side, not in the browser. Operational logs are structured and redacted so credentials and tokens are not written to log output.
No third-party analytics on your BOM contents
Product analytics record event names and counts (for example that an analysis completed). Manufacturer part numbers, designators and BOM contents are not sent to third-party analytics.
What we do not claim
PartOptix holds no SOC 2, ISO 27001, PCI or HIPAA certification today, and we will not claim one until an audit is completed. Engineering results are decision support, not a guarantee of component compatibility.
Reporting a vulnerability
Email security@partoptix.com with reproduction steps. Please do not run automated load-generating scans against production. We will acknowledge reports and keep you updated while we investigate.