Privacy & security
What happens to your data when you use AdvisorAI, and how the service is protected. Last updated 24 September 2026.
Summary
- No account, no registration, no contact form.
- Uploaded models are processed in memory and are not stored.
- No analytics, advertising or tracking; no third-party scripts or fonts.
- All traffic is encrypted with HTTPS.
Your files
An STL file uploaded to the tool is held in the server's memory, linked only to your browser session, while you work. It is discarded when the session ends (closing the tab, or after a period of inactivity) or when you click Start a new session. It is not written to disk and is not visible to other users. Files sent to the programmatic API are processed from a private temporary file that is deleted immediately afterwards. The operator can enable long-term storage (KEEP_UPLOADS); it is off by default. When it is on, files are stored under random names that are not linked to you.
Generated G-code, reports and data exports are created on request and downloaded directly to your device.
Cookies
The tool sets one technical cookie, _streamlit_xsrf. It protects file uploads against cross-site request forgery and holds no personal information. The website sets no cookies.
Server logs
Like any web server, the service records technical access logs: time, requested page, status code, browser type and IP address. They are used only to operate and protect the service, for example rate limiting and investigating errors. They are deleted automatically after 14 days. Application error logs contain a reference code and the type of error, but never the contents of uploaded files.
Third parties
Pages and the tool are served entirely from this server. No external content-delivery networks, analytics services or fonts are used, so your browser makes no requests to third parties while you use AdvisorAI. The TLS certificate is issued by Let's Encrypt.
Security measures
| Area | Measure |
|---|---|
| Transport | HTTPS only (TLS 1.2+), HTTP redirected, HSTS |
| Browser protections | Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy |
| Uploads | Type allow-list, size limit, structural check, triangle limit, coordinate sanity check, no storage by default |
| Input validation | Bounded numeric inputs in the tool; strict schemas, ranges and identifier patterns in the API |
| Errors | Users see a friendly message and a reference code; details stay in the server log |
| Access control | Administrative functions need a secret token and are blocked at the proxy; the application services listen only on localhost |
| Abuse protection | Rate limits on uploads and API calls; request-size limits |
| Configuration | Secrets only in a root-owned environment file, never in source code |
| Operating system | Firewall (only 22, 80, 443), unprivileged service account, systemd sandboxing, automatic security updates |
Report a vulnerability
If you believe you have found a security problem, please email khakimov99h@gmail.com with a description and steps to reproduce it. Please do not test against other users' sessions, run denial-of-service tests, or disclose the issue publicly before it is fixed. The machine-readable contact is published at /.well-known/security.txt.