SEC-01 · THE VAULT Security at PackOS
Your unreleased artwork is safe here.
Pre-launch packaging is one of the most sensitive files a brand owns — it names the product before the product exists. We built PackOS the way we'd want our own launches handled: analyzed in your browser, stored in a private vault, never shared, never trained on, deleted when you say so. No theater — here are the actual controls, in plain language.
Nº 01 The life of your file
Five steps. No surprises.
You drop a file
Artwork, a dieline, an invoice — over an encrypted connection (TLS).
Analyzed in your browser
The dieline, 3D proof, and quote preview are computed client-side — you see everything before we ask for an email.
Stored in a private vault
Files live in a private cloud bucket — never on a public URL. Access uses short-lived signed links.
Used only for your work
Your files prepare your quote, proofs, and production. That's the whole list.
Deleted on request
Say the word and your files are removed from the vault. One email is enough.
WE ALWAYS
- Encrypt in transit. Every upload and page travels over TLS.
- Keep storage private. Files sit in access-controlled buckets, never public.
- Expire access links. Internal file access uses time-limited signed URLs.
- Fail closed. If an internal access check can't verify, it denies.
- Minimize data. We ask for your email only when you request pricing.
- Test ourselves. We run adversarial security reviews against our own product and fix what they find.
WE NEVER
- Sell or share your artwork. Not with partners, not with anyone.
- Train AI on your files. Your designs are not model food.
- Expose public file URLs. There is no guessable link to your artwork.
- Gate the preview behind payment or credentials. You see your dieline and 3D proof first.
- Keep what you've asked us to delete. Deletion means deleted from the vault.
Nº 02 The measures
The spec sheet, not the sales sheet.
- TRANSPORT
- TLS encryption on every connection — uploads, previews, quotes.
- PROCESSING
- Client-side analysis. Dieline detection, 3D proofing, and quote preparation run in your browser session — your file isn't parsed on a shared server to show you a preview.
- STORAGE
- Private cloud vault (Google Cloud Storage). No public buckets, no public objects, no directory listings.
- VOICE
- Live and unstored. The optional voice assistant on the enterprise request sheet streams over an encrypted session with a single-use key that expires in minutes. We keep no recording and no transcript — only what lands on the form you review and send.
- ACCESS
- Short-lived signed URLs for every internal retrieval, plus a fail-closed token gate on internal tools — no valid token, no access, no exceptions.
- APP HARDENING
- Adversarially reviewed and hardened: XSS-safe rendering of untrusted file content, decompression-bomb limits on imports, no open relays or proxies, authenticated export endpoints.
- DATA MINIMIZATION
- No account required to preview. Email is requested once — when you ask for pricing. Analytics are aggregate and never include your file contents.
- YOUR RIGHTS
- Your files remain yours. Request deletion at any time and we remove them from storage. Request a copy and we send it back.
Found something? Tell us first.
We take reports seriously and respond fast. Write to security@packos.ai — responsible disclosure is always welcome, and always answered by a human.
Try it with your most sensitive file.
That's the point. Preview the full dieline and 3D proof before you ever hand over an email.