Data & CAD File Security

Version 1.0 · Draft — not yet in effect

Draft — requires attorney review. This page is a practical starting draft, not a substitute for legal advice. Do not publish it as final without review by counsel qualified in California and U.S. privacy/consumer-protection law.

Export-controlled, classified, and CUI data — do not send it here

This form and its storage are general commercial infrastructure. They are not an authorized environment for export-controlled or classified technical data. Please do not upload, email, or otherwise transmit any of the following to Wrex Products without first agreeing an appropriate transfer method with us in writing:

Technical data controlled under ITAR (International Traffic in Arms Regulations). Wrex Products is not ITAR registered, and ITAR-controlled programs are not a fit for us — see our Quality & Certifications page.
Technical data controlled under the EAR (Export Administration Regulations), including anything with an ECCN other than EAR99.
Controlled Unclassified Information (CUI), including data subject to DFARS 252.204-7012, NIST SP 800-171, or CMMC requirements.
Classified information of any kind, at any level.

We have not assessed or certified this upload path against NIST SP 800-171, CMMC, FedRAMP, or any equivalent framework, and we do not represent it as meeting them. Sending controlled data through an unauthorized channel can itself be a violation, regardless of what the recipient subsequently does with it — which is why we ask you to stop and call before uploading rather than after.

If your project involves controlled data, contact us first and we will tell you plainly whether the work is something we can take, and if so, how the data should be transferred. We would rather decline a project early than receive data we are not authorized to hold.

How uploads work

When you upload a drawing or CAD file through our RFQ form, your browser uploads it directly to a private object storage bucket using a short-lived, single-use signed URL. The file never passes through or is stored on our general web application server.

Storage protections

The storage bucket has no public read access — files are not reachable by a guessable or shared URL.
Files are encrypted in transit (TLS) and at rest (server-side encryption).
Only authorized Wrex staff with a business need can access the storage bucket. This describes the bucket — for what we send onward in order to quote, see “Who else sees your files” below.
Access to uploaded files is logged.
File type is restricted to common engineering formats (PDF, STEP, STP, IGES, IGS, STL, DXF, DWG, X_T, SLDPRT, SLDASM, ZIP) and size-limited; both are enforced server-side, not just in the browser.

What we send by email

Internal notification emails about your submission reference the file's private storage location only — they never include the file's contents or a public link.

Who else sees your files

Quoting your part means sending your drawings or CAD geometry outside Wrex, including outside the United States. We would rather say that plainly here than have you discover it later. We are a manufacturer, not a broker, but we do not make every element of a part in-house and we do not set raw-material or tooling prices — so to return a real number we send what is needed to price the work to:

Tooling vendors — mold and die makers, in the U.S. and outside it.
Raw material suppliers and distributors — for resin and alloy pricing and availability.
Subcontractors and outside machine shops — for secondary operations, finishing, plating and coating.
Component and sub-assembly suppliers — where a part includes items we buy rather than make.

Some of those vendors are outside the United States — including, but not limited to, China, India, Taiwan, Vietnam and Hong Kong. If your project must stay in the United States, or must not go to a particular country or a named competitor, tell us before you upload. We will tell you whether we can quote it on that basis — and if we cannot, we will say so rather than quote it anyway.

An NDA governs this sharing; it does not prevent it. A signed NDA is our commitment to protect your information — not a commitment that your drawings never leave our building, because a quote cannot be produced that way.

We do not have a confidentiality agreement with every vendor we quote through. Some are under an NDA or NNN agreement with us; some are not. Nor are all of them ISO 9001 registered. If your project requires that every recipient be under a written confidentiality obligation, that recipients be approved in advance, or that particular countries or named competitors are excluded, tell us before you upload. We can often quote on that basis, but it may limit which vendors we can use — and we would rather tell you that up front than discover it after your geometry has gone out.

Recipients keep their own copies. A vendor who quotes your tool holds your drawings in their systems, mailboxes and backups, on their own retention schedule. We do not control that, and neither an NDA nor a later deletion request changes what has already been received — it only obliges them to protect it and to act on a request we pass on.

We may also use AI applications to help review, interpret and quote a project, which can mean providing project information — potentially including geometry — to those tools. [Management and counsel to approve the specific AI tools and confirm their terms permit confidential business input and prohibit training on it.]

This is also the practical reason for the export-control warning at the top of this page. Our normal quoting route transmits technical data to foreign parties. For ITAR- or EAR-controlled data that transmission can itself be the violation, whatever the recipient does next — which is why we ask you to stop and call first.

Retention and deletion

Uploaded files are deleted from the website’s file storage 365 days after upload, by an automatic rule on the storage itself rather than by anyone remembering to run it.

That is not the same as Wrex no longer holding your drawing. The notification emails that reference it stay in Wrex mailboxes, and any copy taken into our quoting or quality systems is kept on the same indefinite basis. We would rather tell you that than let a storage schedule read as a deletion promise.

One store is different and worth naming precisely: the website's own submission record — the form text and metadata it keeps to recognise a duplicate submission — expires automatically after a set period (currently one year). That is separate from the file itself and from the email.

Backups are not selectively editable. Backups, snapshots and shadow copies of our servers, databases, mailboxes, website and logs exist so we can recover from failure. We cannot surgically remove one project from them; they age out on their own cycle. The same applies to our vendors and suppliers.

To request deletion, write to info@wrexproducts.com addressed to Wrex management, identifying the project or reference, and allow reasonable time. We can remove files from the systems we actively use and pass your request to vendors who received them; we cannot guarantee a third company's internal systems, and some records may need to be retained for legal, tax, warranty, quality or contractual reasons. Our Privacy Policy sets this out in full.

Security scanning

Traffic to this site, including uploads, passes through our network and security provider (currently Cloudflare) for delivery, filtering and abuse protection. Files opened by Wrex staff are scanned by the endpoint security software on those computers.

Uploaded files are scanned for malware, and the upload path additionally restricts file type and size and stores files in a private bucket. [LAUNCH GATE — this paragraph must not publish until it is true. As of 2026-08-17 MALWARE_SCAN_REQUIRED is false and no scanner is wired up (lib/uploads.ts checks a scan-status that nothing sets). Harshal will enable scanning at go-live; verify it is actually on and rejecting a known-bad test file BEFORE this page goes public. Never route customer CAD through a public malware-analysis service.]

NDA requests

You can request a mutual NDA directly on the RFQ form before providing further project detail. We'll send one for signature before discussing specifics beyond what's needed for an initial quote.