Security

Your client’s drawings stay under your control.

EPC projects run under strict confidentiality terms. Cadmium is built to meet them, wherever you need it to run.

Your environmentcloud, your tenancy or on-premises

Project-level accessroles, SSO and audit logs

AES-256 and TLS 1.2+encrypted at rest and in transit

No model trainingon your data, ever

Deployment

Run it where your contract says it must run.

Option	Where it runs	Best for
Cadmium Cloud	Single-tenant, in your chosen region	Fast starts and pilots
Your cloud	Your AWS, Azure or GCP account	Keeping data in your own tenancy
On-premises	Your data centre, including air-gapped	Restricted and government projects

Access and control

SAML and OIDC with your identity provider, with SCIM provisioning and enforced multi-factor authentication.

Separate access for each project, discipline and partner, with least privilege by default.

Every view, download, run and change is logged and can be exported to your SIEM.

Questions security teams ask

Is our data used to train models?

No. Customer drawings and models are never used to train models shared with other customers.

Where is our data stored?

In the region you choose, or entirely inside your own environment. Data never leaves it without your approval.

Can it run without internet access?

Yes. The on-premises edition runs on air-gapped networks, with updates delivered as signed packages.

How do we delete a project?

Project owners can delete a project at any time. Data is purged from storage and backups within 30 days.

Can we restrict access by project?

Yes. Access is role-based and set per project, including for joint-venture partners and subcontractors.

Will you complete our security questionnaire?

Yes. We respond to vendor security reviews and can walk your team through our controls under NDA.

Pilot

Bring real project data under NDA. We run it with your team, on your templates, so your engineers can judge the output against their own work.