Security.

Workspace isolation

• When you are signed in, every request is checked against your membership in the workspace it asks about. When someone is removed from a workspace, their next request is refused, even if they are still signed in.
• Automated checks run on every change to our code and block any route that skips this check or looks up a record outside the caller's workspace.
• Links you share with buyers, suppliers and factories open without an account, so no membership is checked when they are used. Each link carries a long random token that cannot be guessed and opens only the record it was made for. Anyone you forward a link to can open it too. Many of these links can be turned off, and some expire on their own.

Where your data lives

The app runs on Vercel in the US East region, and your workspace data is stored in a Postgres database hosted by Neon. Files you upload are stored in Vercel Blob. Every connection to StitchGrid is encrypted with TLS.

How we use AI

• StitchGrid never uses one customer's designs, tech packs, quotes or prices to produce another customer's output. Cost estimates learn only from the quotes returned to your own workspace.
• Requests that read text or images go to Anthropic, and speech-to-text requests go to OpenAI, both through the Vercel AI Gateway. Every one of those requests instructs the Gateway to use only providers that have agreed not to train on prompts.
• Image generation runs on fal.ai and read-aloud audio on ElevenLabs. Neither provider gives us a way to keep the data we send out of training, so this page makes no training promise for either of them.
• One thing is shared on purpose. A factory in the StitchGrid network has a single scorecard, and its on-time delivery and quality rates are pooled across every brand that orders from it. The scorecard shows rates and counts only and never names a brand or an order.

Accounts and access

• New accounts are created by invitation only.
• Passwords are hashed with bcrypt. API keys and OAuth tokens are stored only as hashes. The tokens that connect your other tools are stored encrypted with AES-256-GCM.
• Two-step sign-in with an authenticator app is available to every account in Settings, with single-use recovery codes, and it is required for StitchGrid staff. Turning it on asks for your password.
• You can remove a member, revoke an API key or disconnect a connected app at any time.
• Important changes in a workspace are recorded in an audit log.

Your data

You can export your workspace's orders, samples and suppliers from Settings, and each tech pack downloads as a spreadsheet. To delete your account, email hello@stitchgrid.com. Our privacy policy explains what we keep afterward for legal and tax reasons.

Subprocessors

These companies process data on our behalf to run StitchGrid.

• Vercel Hosting, file storage and the AI Gateway.
• Neon The Postgres database.
• Anthropic AI models that read text and images, through the Vercel AI Gateway.
• OpenAI Speech-to-text, through the Vercel AI Gateway.
• fal.ai Image generation.
• ElevenLabs Text-to-speech.
• PostHog Product analytics, session replay and error reporting.
• Resend Email delivery.
• Stripe Payments.
• Wise Payouts to factories. Wise receives each factory's name and bank details and the amount paid.
• Apple Push notifications to the StitchGrid iPhone app. Apple receives the device token and the text of each notification.
• Upstash Rate limiting.

Reporting a vulnerability

If you find a security problem, email hello@stitchgrid.com with the details and the steps to reproduce it. We read every report and reply within one business day, and we ask that you give us a fair chance to fix the issue before you share it.