Skip to main content

Privacy Attestation

  • Issuer: draw.io Ltd
  • Product: diagrams.net
  • Version: 2.2
  • Published: 13 October 2026
  • Status: Published
  • Author: David Benson

Purpose​

This attestation is published by draw.io Ltd as a formal statement of the privacy and data-handling position of diagrams.net. It exists so that organizations evaluating diagrams.net can rely on a single, versioned document rather than negotiating individual contracts. It is a living document; material changes will be published as a new version at the same canonical URL.

The version number and publication date above identify the version of the commitments in force. Organizations relying on this attestation should record the version number they relied on.

Issuer​

draw.io Ltd is a UK private limited company.

draw.io Ltd
Artisans' House, 7 Queensbridge
Northampton NN4 7BF
United Kingdom

The named security and privacy contact is David Benson.

1. Scope of Data Handled​

diagrams.net does not collect personally identifiable information. It does not store user-created content on draw.io Ltd infrastructure, apart from the short-lived collaboration cache described below.

Diagrams are created and edited entirely within the user's browser. Diagrams are saved to the storage the user or institution chooses (the user's local device, Google Drive, Microsoft OneDrive, Confluence, Jira, GitHub, GitLab, Nextcloud, and similar). draw.io Ltd has no access to that storage and does not receive a copy.

Diagram content leaves the user's browser only when the user uses one of these functions:

  • PDF and image export, where the browser cannot produce the file itself, sends the diagram to a serverless conversion service on Cloudflare for rendering. The payload is not logged, not stored, and not retained after the response is returned.
  • Real-time collaboration, for diagrams stored in Google Drive or Microsoft OneDrive. While a diagram is open in more than one place, changes are encrypted in the browser and passed between the open copies through draw.io Ltd's collaboration service, which can hold them in memory, in a cache, for at most 5 minutes. draw.io Ltd does not hold the encryption keys. The cache is not logged or backed up, and entries are deleted automatically.
  • AI features. A request to create or change a diagram, and any diagram included with it, passes through draw.io Ltd's AI service to Anthropic or OpenAI, or to a model that Cloudflare runs, which produces the result. draw.io Ltd does not store or log requests or results. Anthropic and OpenAI do not use them to train models, and delete them within 30 days unless a request is flagged for misuse.
  • Import from a web address. draw.io Ltd's proxy service fetches the file and passes it to the browser without storing it.

Web server logs contain standard request metadata (resource requested, user agent) and are kept for 30 days. They do not contain IP addresses (filtered at the CDN), diagram data, or PII. The web application also reports usage counts that carry no user identifier: the version in use, the kind of storage a diagram is opened from, and, for Google Workspace users, the domain of the organisation. The domain records are kept for 24 months to count the organisations that use diagrams.net.

2. Use Restrictions​

draw.io Ltd does not, and will not:

  • Use any user data for advertising or behavioral targeting.
  • Sell, rent, or trade any user data.
  • Use any user data, including diagram content, to train AI or machine-learning models.
  • Build personal profiles of users.
  • Use diagram content, or any data that identifies a user, for product improvement, analytics, or research. The only usage data draw.io Ltd keeps is the usage counts described in section 1, which carry no user identifier.

These commitments are technically reinforced by the fact that draw.io Ltd does not have the data in the first place.

3. Sub-processors​

The following sub-processors are used:

  • Cloudflare, Inc. - delivers the web application to users, processing their IP addresses to do so and to limit abuse; it is the only sub-processor that sees users' IP addresses. It runs the conversion service for PDF and image export (in Germany), the real-time collaboration relay and its cache (in the EU; the cache can hold encrypted diagram changes in memory for at most 5 minutes), and the web-address proxy, the AI service and the AI models it runs itself (in the Cloudflare data centre nearest the user). It also runs the sign-in service used when connecting cloud storage, which passes access tokens through without storing them. None of these store or log diagram content.
  • Google Cloud (GCP) - receives the web application's error reports and usage counts, in the United States, and keeps them in its logs for 30 days. They contain no IP addresses, diagram data or PII. The records of the Google Workspace domains described in section 1 are kept in the United Kingdom for 24 months.
  • Anthropic and OpenAI - provide the AI models used by the AI features, processing requests in the United States. Neither uses them to train models. Anthropic deletes them within 30 days, or keeps them for up to 2 years if they are flagged for misuse; OpenAI keeps them for up to 30 days to detect misuse. Transfers are covered by the standard contractual clauses and the UK Addendum in each provider's data processing terms.

Each sub-processor's own data-protection terms apply to its processing.

draw.io Ltd will update this attestation when sub-processors are added, removed, or changed.

4. Security Controls​

draw.io Ltd operates an Information Security Management System (ISMS). Relevant policies include the Information Security Policy, Change Management Policy, Breach Notification Policy, and Risk Management Policy.

  • All data in transit is encrypted using current industry-standard cryptography.
  • There is no user data at rest on draw.io Ltd infrastructure to encrypt: none is stored, and the collaboration cache holds data in memory only.
  • Access to draw.io Ltd production systems is controlled under the principle of least privilege, with strong authentication.
  • A public bug bounty program is operated via Bugcrowd. Findings and historical penetration test reports are tracked internally and remediated through the change management process.
  • draw.io Ltd is working toward SOC 2 certification. This attestation will be updated when that work reaches a reportable milestone. Specific framework certifications (ISO 27001, SOC 2 Type I/II, NIST) are not currently held by draw.io Ltd.

5. Breach Notification​

In the event of a security breach affecting draw.io Ltd systems, draw.io Ltd will:

  • Notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where the breach is notifiable under UK GDPR.
  • Publish a public advisory describing the breach and its impact at the canonical product communications channels.

Because draw.io Ltd does not maintain a list of end-user organizations (no accounts, no PII, no contact records), notification to affected organizations is by published advisory rather than direct per-customer notification. Organizations relying on this attestation should subscribe to or monitor the published product communications channels accordingly.

6. Data Return, Deletion, and Termination​

draw.io Ltd does not hold any user data beyond the collaboration cache entries described in section 1, which are deleted automatically within 5 minutes. There is therefore nothing to return, nothing to delete, and no certificate of destruction is applicable. Termination of use of the product has no data-handling consequences on the draw.io Ltd side.

Data held by the user's chosen storage provider (Google Drive, OneDrive, Confluence, Jira, GitHub, GitLab, etc.) is the responsibility of that provider and the organization that contracts with it.

7. Insurance​

draw.io Ltd carries cyber liability insurance underwritten by Hiscox Insurance Company Limited, with a limit of indemnity of GBP 1,000,000 in the aggregate and worldwide geographical limits. Cover is held on a continuing basis and renews annually. Evidence of cover is available on request.

8. Governing Law and Jurisdiction​

This attestation, and any commitments made within it, are governed by the laws of England and Wales. draw.io Ltd is a UK company and does not accept the jurisdiction of any non-UK court for matters arising from this attestation.

9. Changes to This Attestation​

draw.io Ltd will publish material changes to this attestation as new versions, with an updated version number and publication date. The version number and publication date at the top of this document identify the in-force version. Organizations relying on this attestation should record the version number they relied on.

Changes from Version 2.1​

  • Section 1 lists every function that sends diagram content from the browser: PDF and image export, real-time collaboration (with a cache held in memory for at most 5 minutes), the AI features, and import from a web address.
  • Section 1 states how long web server logs are kept, the usage counts the web application reports, and that the Google Workspace domain records are kept for 24 months.
  • Section 2 limits the analytics commitment to diagram content and data that identifies a user, and names the usage counts in section 1 as the only usage data kept.
  • Section 3 lists all sub-processors, including the AI model providers Anthropic and OpenAI in the United States, where each processes data, how long the AI providers keep requests, and the transfer mechanism for each. It states that Cloudflare is the only sub-processor that sees users' IP addresses and runs the sign-in service for cloud storage connections, and that the Google Workspace domain records are kept in the United Kingdom.
  • Sections 4 and 6 reflect the collaboration cache.