Render
Hosting, in Frankfurt, Germany
Runs the service, its database and the encrypted disk your drawings are stored on, and snapshots that disk every day.
- ISO 27001
- SOC 2 Type 2
- EU-US Data Privacy Framework
SECURITY
Security for
your drawings.
Handing a client’s drawings to a new tool is a fair moment to ask where they go and who can read them. Here is the answer, from the way Redline is built, with checks you can run yourself.
How does Redline protect drawings?
Drawings are rendered and measured in your browser, sent to Redline only over HTTPS, stored in Frankfurt, Germany, and encrypted at rest with AES-256-GCM, sealed to your account. Three public scanners grade redlinepdf.net A+. Hosting, account email and payments run on Render, Resend and Paddle, each of which states on its own site that it holds a SOC 2 Type 2 report.
Independent checks
- A+SSL Labs: grade from Qualys SSL Labs, checked 8 October 2026 (opens in a new tab)
- A+Mozilla Observatory: grade from Mozilla HTTP Observatory, checked 8 October 2026 (opens in a new tab)
- A+Security Headers: grade from Security Headers, checked 8 October 2026 (opens in a new tab)
- TLS 1.3Encrypted in transit: HTTPS only, as the SSL Labs scan of 8 October 2026 shows (opens in a new tab)
Protection
- AES-256Encrypted at rest: drawings are encrypted with AES-256-GCM and sealed to your account
- EU hostedFrankfurt, Germany: the service, its database and your stored drawings are in Frankfurt, Germany
- Certified hostingRender’s ISO 27001, SOC 2: hosted on Render, whose ISO 27001 certification and SOC 2 Type 2 report are Render’s own
- Leaked passwordsChecked when set: each new password is checked against Have I Been Pwned’s list of leaked passwords
- No trackersNo ads or tracking cookies: no ads, no tracking cookies and no third-party trackers on Redline’s pages
Payments
Independent checks
Three public scanners grade the site from outside, with nothing to install and no account. Anyone can run them again; the links below start a fresh scan of redlinepdf.net.
Qualys SSL Labs, grade A+
The HTTPS connection itself: the certificate, the protocol versions, the key exchange and the ciphers.
Mozilla HTTP Observatory, grade A+
How the site tells browsers to protect you: content security policy, HTTPS only, cookies, framing and referrer rules.
Security Headers, grade A+
The security headers sent with every page, and whether any is missing.
How your drawings are protected
In the browser first
Drawings are rendered, marked up, measured and exported in your browser, on your own device. A drawing is uploaded only when you open or save it in your signed-in workspace. The demo and the free measuring tool never upload your drawing.
In transit
Every connection is HTTPS, with TLS 1.3 (or 1.2 for older browsers). Browsers are told to use nothing but HTTPS for this domain and every name under it for a year, and a plain-HTTP request is sent to the HTTPS address.
At rest
Each drawing, its PDF, its markups, its checkpoints and your saved preferences are encrypted with AES-256-GCM and sealed to your account and to that record, so one account’s data cannot be read as another’s. This is server-side encryption: the service holds the key in order to show you your own work.
Backups
Render takes an encrypted snapshot of the service’s disk every day and keeps each one for at least seven days.
Where it is hosted
The service, its database and every drawing it stores are on Render’s infrastructure in Frankfurt, Germany.
Accounts and sign-in
An account opens only through a code or link sent to its email address, so nobody can open one for an address they cannot read. Passwords are at least 15 characters and are kept only as a salted scrypt hash. Each new password is checked against Have I Been Pwned’s list of leaked passwords using the first five characters of its SHA-1 hash, so the password itself never leaves Redline. Wrong guesses are counted per connection and per address, sign-in links expire after 15 minutes, and the emails anyone can ask us to send are capped per inbox and per connection.
Sessions
Signing in sets one random session token in a cookie marked HttpOnly, SameSite=Strict and Secure: scripts on the page cannot read it and other sites cannot send it. The server keeps only a hash of it, a session lasts at most seven days, and every change also needs a per-session CSRF token and must come from Redline’s own address.
The pages themselves
Every response carries a strict Content-Security-Policy: scripts run only from Redline itself and, when you open a checkout, from Paddle; no plugins; and no other site may frame Redline. Pages also tell browsers not to guess file types, send no referrer, and switch off the camera, microphone, location and other sensors the app has no use for. There are no ads and no third-party trackers, and the typeface is served from Redline’s own address.
Payments
Paddle runs the checkout as merchant of record, in its own checkout that opens over the page. Card details go to Paddle and never reach Redline. Paddle tells us which plan a subscription is on, its status, when the paid period ends and a customer reference, in notifications we verify by signature. The 30-day trial asks for no card, and a subscription can be cancelled at any time from your workspace.
Deletion
You can delete your account from the workspace at any time. Its sessions end at once; its data is kept, still encrypted, for 30 days so a mistaken deletion can be undone, and is then erased for good. Backups age out on their own schedule after that.
Built on independently audited providers
Redline runs on a few specialist providers. The certifications, audit reports and compliance below are each provider’s own, as its own page states them; follow the link under each to read it there.
Cloudflare, through Render
The network in front of Render
Carries the site’s traffic to Render. Render lists Cloudflare among the subprocessors of its platform.
- ISO 27001:2022
- SOC 2 Type II
- PCI DSS 4.0
Resend
Account emails
Delivers sign-up codes, sign-in links and account emails such as trial reminders. It receives the address and the message.
- SOC 2 Type II
- GDPR compliant
Paddle
Payments, as merchant of record
Runs the checkout and holds card, billing address and tax details. It tells Redline which plan a subscription is on, its status, when the paid period ends and a customer reference, never the card.
- SOC 2 Type II
- PCI DSS 4.0.1
For IT and procurement
Short answers to the questions a firm’s IT lead asks before drawings go into a new tool.
Where is our data stored?
Drawings, markups and account records are stored on Render in Frankfurt, Germany, on a disk Render encrypts; drawings, markups and preferences are also encrypted by Redline itself with AES-256-GCM. Card and billing details are held by Paddle, and the email address and message of each account email pass through Resend.
Who can see our drawings?
Only the account that saved them. Every request is checked against the signed-in account, each drawing is sealed to it, and drawings are not shared between accounts. The service holds the encryption key so it can show you your work; its administration view lists accounts and counts, never what a drawing contains.
Which sub-processors are involved?
Render for hosting, whose traffic runs through Cloudflare; Paddle for payments; Resend for account emails. When a password is chosen, Have I Been Pwned receives the first five characters of its SHA-1 hash and nothing else. The privacy policy lists the same, with what each one receives.
How long is data kept, and how is it deleted?
For as long as the account exists. A deleted account is kept, still encrypted, for 30 days in case the deletion was a mistake, then erased; backups age out after that. Short-lived records, such as sign-in counters (15 minutes) and email counters (a day), are listed in the privacy policy.
Can we get our work out?
Yes, at any time and on every plan. Download any drawing from the workspace as a Redline project file carrying the PDF and every markup, export PDFs from the editor (Free adds a small footer; Plus and Pro export clean, or with editable annotations other PDF tools open), and on Pro export the takeoff as CSV.
Is our data used for anything else?
Your drawings are used for nothing but your own workspace. Your data is not sold or shared, and it is not used to train anything.
What happens if something goes wrong?
If a security incident affects your data, we will tell the customers affected by email without undue delay: what happened, what it touched and what we are doing about it. The daily encrypted snapshots are there to restore from.
Report a security issue
Email support@redline-services.net with “Security” in the subject. Tell us what you found and how to reproduce it; we will reply, and tell you when it is fixed. Please give us the chance to fix it before you share it. The same contact details are in machine-readable form at redlinepdf.net/.well-known/security.txt.
Try it on the sample drawing
Redline runs in the browser — nothing to install. Open the demo to try tools on a sample drawing. Demo edits are temporary; your own files, saving, signatures, exporting, printing and downloads come with an account, which starts with 30 days of Pro, no card. Then Free unless you choose Plus or Pro; your drawings stay. Plus is $9 a month or $90 a year; Pro is $15 a month or $150 a year. Compare the plans.
More: all guides