DeepMech - Data Security White Paper

Version: v2.0｜Updated: 2026-07-14 Applies to: DeepMech Basic, DeepMech Pro, DeepMech Enterprise

What you entrust to us is more than drawings—it is quotation data, customer records, account credentials and payment information. We treat them as your company’s core assets and protect each category at the product architecture level, not with after-the-fact patches.

This white paper explains the technical safeguards we have implemented and our compliance commitments.

1. What Data We Protect

2. Local Drawing Processing (Our Core Difference)

Most machining SaaS products require you to upload complete drawings to their servers first, where AI parses them and returns a quote. That means your core drawing data leaves your device and enters a third-party server.

We take a fundamentally different approach:

• AI parsing is performed locally in your desktop app first, and at the quoting stage only de-identified feature parameters are uploaded—structured fields such as hole coordinates, dimensions, tolerance grades and surface treatment requirements, not the drawing itself
• When AI parsing is needed, drawings are sent over TLS-encrypted channels and stored encrypted on the server, visible only to your account
• Outgoing documents do not include drawings by default: when you send a quotation / purchase order to a partner, the recipient by default sees only the document content and your signature block; only when you actively choose to share drawings at the time of sending can the designated recipient view them (you decide whether the original can be downloaded; sharing is revoked immediately once the document is voided)

3. Quotation and Business Data Isolation

Your quotations hold your cost structure and customer list—this protection is also built into the architecture:

• Strict account isolation: quotations, customer records and cost parameters are checked against account ownership, and every API access verifies who owns the resource
• Whitelist projection for external sharing: the online quotation view page and the recipient’s inbox show only the customer-facing quotation fields (item name, quantity, unit price, subtotal); your internal costs, margins, hourly rates and other sensitive fields are never sent out—this is a server-side whitelist, not front-end hiding
• Tokenized share links: every customer-facing quotation uses its own random-token link that cannot be enumerated or guessed
• Custom pricing parameters in Pro (your material prices and machining rates) are used only for your own cost calculations and are never shared or shown in aggregate to any other user

4. Customer Data Is Never Used for Model Training

We solemnly commit:

• Your drawings, quotation data and business information will never be included in our AI model training datasets
• The models we have trained are based on public datasets and data authorized by partner customers
• The AI call pipeline applies de-identification: user content in call logs is filtered for sensitive information, file names are replaced with hashes, and original file names are not recorded
• If in the future we need a specific customer’s data to improve a model (for example, training for a special process), we will sign a dedicated authorization agreement in advance stating the purpose, scope and duration, and never use it without the customer’s knowledge

This commitment is written into our service agreement.

5. Account and Device Security

• Passwords are stored as bcrypt one-way hashes: salt rounds = 10, in line with the OWASP recommended baseline; not even DeepMech staff can see your plaintext password
• One-code-one-machine device binding: the activation code is bound to a device fingerprint and unbound devices cannot sign in; you can unbind and switch devices yourself, up to 2 times in any rolling 30-day period, which prevents account sharing
• Single-device sessions: only 1 device may be online per account at any time; a new sign-in ends the previous session
• JWT Bearer Token authentication + HMAC-SHA256 request signing: every request from the desktop app carries a signature to prevent replay and tampering attacks
• Credential isolation: on the desktop, sensitive keys and signing logic run in the Electron main process and are never exposed to the renderer process

6. Payment Security

• All payments are completed through the official WeChat Pay and Alipay channels, with QR codes linking directly to the official checkout
• DeepMech never touches or stores your bank card number, payment password or any payment credentials—our system records only the order number, the amount and the transaction ID returned by the payment channel
• Payment callbacks are booked only after official signature verification, which prevents forged callbacks

7. Access Control and Auditing

• Resource ownership checks: every API verifies that the current user owns the resource; data is strictly isolated between customers
• Tiered admin permissions: super administrators, sales staff and regular administrators each hold only the minimum permissions they need
• Operation logs: key operations (profile changes, status changes, admin actions, etc.) are logged and can be audited
• AI call tracing: every AI call records the caller, scenario and duration; call content is retained in de-identified form and automatically purged after 30 days

8. Data Minimization and Deletion

• Minimum necessary collection: we collect only the information the service actually needs, and nothing unrelated to it
• Retention period: business documents are retained for the period required by law (tax records, dispute handling) and purged afterwards
• Deletion on request: you may request deletion of your data at any time, and we will complete the metadata soft-delete and physical file purge within 30 calendar days

9. Data Boundaries for Professional Reports

For the professional report service (market opportunity / risk due diligence):

• Reports are delivered only to the email address given at payment and never provided to any third party
• All research information comes from public sources (media, court records, business registries, trade databases, social media); no non-public data is obtained
• The information you provide about the research subject is used only to produce that report and never enters any shared data pool

10. Security Incident Response

If a security incident affects customer data:

• Within 72 hours we notify affected customers in writing, describing the nature of the incident, its scope and initial remediation measures
• Full incident report: once the investigation is complete, we provide a full report including root cause analysis and improvement measures
• Support for customer investigations: if your legal or audit team requires it, we cooperate by providing the necessary technical evidence

11. Vulnerability Disclosure and Security Inquiries

We encourage security researchers to disclose vulnerabilities responsibly:

• Security contact email:legal@jiagong.ai
• Vulnerability response: we respond within 5 business days of receiving a qualified vulnerability report and close it out within 30 days
• Acknowledgement and rewards: researchers who help us improve security receive public acknowledgement and a reward based on severity

12. Compliance

Our product design and operations comply with:

• Cybersecurity Law of the People’s Republic of China
• Data Security Law of the People’s Republic of China
• Personal Information Protection Law of the People’s Republic of China
• Information Security Technology – Personal Information Security Specification (GB/T 35273)

If your industry has special compliance requirements (defense, medical devices, automotive Tier 1 suppliers, etc.), please contact our sales team to discuss further.

Contact

• General inquiries: support@jiagong.ai
• Security / legal matters: legal@jiagong.ai
• Customer service: 4009-128-168
• Company: Landau Suzhou LLC
• Address: 369 Xiangtai Road, Yangchenghu Town, Xiangcheng District, Suzhou, China