Data Security

Definition: Data security is the set of technical and organizational measures that protect data from unauthorized access, manipulation, loss or theft. For 3D platforms and CAD data, this includes encryption, access control, DRM (Digital Rights Management), secure transfer and compliance with security standards.

In B2B mechanical engineering, data security is critical for these tasks: protect confidential CAD designs, share 3D models securely with customers and partners, prevent IP theft (intellectual property), comply with ISO 27001, SOC 2 and TISAX, and use cloud 3D visualization platforms securely.

Key question: How can machine builders use confidential CAD data (web viewers, AR, customer presentations) without IP risks?

English: Data Security, Information Security German: Datensicherheit, Informationssicherheit

Threat Scenarios

Unauthorized access to CAD data

Risk: Design data gets into the wrong hands.

Scenarios: - Outsiders get access to the cloud platform (weak passwords) - Former employees keep their access - A phishing attack compromises an admin account - Unsecured share links are forwarded

Damage: A competitor copies the design, the customer loses trust, legal consequences.

IP theft during customer presentations

Risk: 3D models are stolen during demos.

Scenarios: - The customer downloads the 3D model from the web viewer (browser cache) - AR app files are extracted from the customer's device - Screenshots or screen recordings of confidential details - Demo links are shared with third parties

Damage: Competitors replicate the product, loss of competitive advantage.

Data loss from technical failures

Risk: Design data is lost permanently.

Scenarios: - Cloud provider outage without a backup - Ransomware encrypts CAD data - Accidental deletion without recovery - Hardware failure (local storage without redundancy)

Damage: Project delays, models must be rebuilt, customer appointments are at risk.

Man-in-the-middle attacks

Risk: Data is intercepted during transfer.

Scenarios: - Unencrypted CAD upload to a cloud platform - Download of 3D models over an insecure network - API communication without TLS

Damage: Confidential designs are intercepted, data is manipulated.

Security Measures

Encryption

Transport encryption (TLS/SSL): Data is encrypted during transfer: - HTTPS for web viewers - TLS 1.3 for API communication - Encrypted CAD uploads to the cloud

At-rest encryption: Data is stored encrypted on servers: - AES-256 for stored 3D models - Encrypted databases - Encrypted file systems

End-to-end encryption: Only the sender and the recipient can decrypt the data: - Client-side encryption (before upload) - The cloud provider sees only encrypted data - Zero-knowledge architecture

Best practice: At least TLS 1.2, ideally AES-256 at-rest encryption.

Access control

Role-based access control (RBAC): Users get only the permissions they need: - Administrator: Full access - Design engineer: Upload and edit own models - Sales: View only, share with customers - Customer: Time-limited access to shared models

Multi-factor authentication (MFA): An additional security layer: - Password + SMS code - Password + authenticator app (TOTP) - Password + hardware token (YubiKey)

Temporary access: Time-limited sharing: - Demo link valid for 7 days - Customer access expires at the end of the project - Unused access is revoked automatically

IP whitelisting: Access only from defined networks: - Only from the company IP range - VPN required for external access

Best practice: MFA for all users, RBAC with the principle of least privilege.

Digital Rights Management (DRM)

Watermarking: Invisible marks in 3D models: - Embedded metadata (company, date, recipient) - Geometric watermarks (minimal changes to the geometry) - Traceability of leaks (which customer shared the file?)

Download prevention: Technical measures against saving: - Web viewer without a download button - Obfuscated asset URLs (no direct access) - Streaming instead of local storage - Browser cache control (no local caching)

Screen capture protection: Makes screenshots and recordings more difficult: - Real-time watermark overlay (with the user name) - Lower resolution for presentations (details are not visible) - DRM-protected display (makes screen recording more difficult)

Limitation: 100% protection is not possible (a camera photo of the screen), but you can raise the barriers.

Secure cloud architecture

ISO 27001 certification: International standard for information security management systems: - Regular audits - Documented security processes - Risk management

SOC 2 Type II: Report on security controls (US standard): - Security, availability, processing integrity - Annual audit by external auditors

TISAX (automotive industry): Security standard for the automotive industry: - Mandatory for automotive suppliers - Based on ISO 27001, with extended requirements

Geographic data residency: Data stays in a defined region: - Data storage in the EU (GDPR compliance) - No data transfer to third countries - Local server locations

Best practice: Select a platform provider with ISO 27001 + SOC 2.

Cloud vs. On-Premise

Cloud solution (SaaS)

✅ Advantages: - Professional security teams (24/7 monitoring) - Automatic updates and patches - Scalable security infrastructure - Certifications (ISO 27001, SOC 2) are often available - Redundancy and backups included

❌ Disadvantages: - Data is outside your own control - Dependency on the provider - Compliance risks (data in third countries) - You must trust the provider

When to use the cloud: Standard security requirements, no in-house IT security team, flexibility is important.

On-premise solution (self-hosted)

✅ Advantages: - Full control over data - No data transfer to third parties - Customizable security policies - Air gap possible (isolated networks)

❌ Disadvantages: - Requires an in-house IT security team - High maintenance effort (updates, patches, monitoring) - High initial costs (hardware, licenses) - Scaling takes much effort

When to use on-premise: Highest security requirements (defense, top-secret automotive projects), an existing IT team, regulatory requirements.

Hybrid approach

A combination of both models: - Confidential original CAD files on-premise - Optimized viewer models in the cloud (reduced geometry) - Temporary cloud use for customer presentations - On-premise for internal reviews

Advantage: A balance between security and convenience.

Secure Sharing with Customers

Share reduced models

Do not share the original CAD: - CAD export with reduced geometry (web-optimized) - Remove details (internal parts, fasteners) - Surface model instead of solid model - Polygon reduction (less precise)

Result: The customer sees the machine but cannot reverse-engineer it.

Example: CNC milling machine – the customer sees the housing and the basic shape, but no spindle details or control electronics.

Time-limited links

One-time links with an expiry date: - Link valid for 7 days - The link expires after the download - No permanent sharing

Technology: Signed URLs with expiration (for example AWS S3 presigned URLs).

Password-protected sharing

An additional barrier: - Email with the link + a separate password (for example by SMS) - Only authorized recipients get access

Terms of use (NDA)

Legal protection: - Non-disclosure agreement - Usage restrictions (internal evaluation only, no sharing) - Legal consequences for violations

Best practice: NDA + reduced model + time-limited access.

Backup and Disaster Recovery

3-2-1 backup rule

3 copies: Original + 2 backups 2 media: Different storage types (for example server + cloud) 1 offsite: At least one copy at an external location

Example: CAD data on a local server + daily backup to a NAS + weekly backup to the cloud.

Versioning

Keep historical versions: - Restore earlier states - Protection against ransomware (encrypted files → restore an older version) - Traceability of changes

Retention policy: For example daily backups for 30 days, weekly backups for 1 year.

Disaster recovery plan

Emergency plan for data loss: - RTO (Recovery Time Objective): maximum downtime (for example 4 h) - RPO (Recovery Point Objective): maximum data loss (for example the last 24 h) - Tested recovery processes (regular drills)

Ransomware protection

Specific measures: - Offline backups (not always connected) - Immutable backups (cannot be changed or deleted) - Fast detection (anomaly detection)

Compliance and Certifications

ISO 27001

International standard for information security: - What: Management system for information security - Content: Risk assessment, security controls, continuous improvement - Certification: External audits (annual)

B2B relevance: Many customers require ISO 27001 (automotive, pharma, aerospace).

SOC 2 Type II

US standard for service providers: - What: Report on security controls - Trust Service Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy - Type II: Operational effectiveness over 6-12 months

B2B relevance: Standard for SaaS platforms, builds trust with US customers.

TISAX

Standard for the automotive industry: - What: Trusted Information Security Assessment Exchange - Basis: ISO 27001 + automotive requirements - Assessment levels: AL1 (basic), AL2 (high), AL3 (very high)

B2B relevance: Mandatory for automotive suppliers.

GDPR (DSGVO)

Data privacy (not data security, but related): - What: EU General Data Protection Regulation - Applies to: Personal data (for example user accounts, not CAD data) - Requirements: Encryption, access controls, data breach notification

B2B relevance: For user management on 3D platforms.

Frequently Asked Questions (FAQ)

Is CAD data secure in the cloud?

It depends on the provider and the configuration. Secure if: ISO 27001/SOC 2 certified, encryption (at rest + in transit), data storage in the EU, MFA enabled, RBAC configured. Risks: Shared responsibility (the provider secures the infrastructure, the customer secures user management), vendor lock-in, compliance uncertainty with third countries. Recommendation: Check the provider certifications, validate the encryption, run a test phase with non-critical data. Rule of thumb: The cloud is more secure than your own infrastructure without a dedicated IT security team.

How do I prevent downloads of 3D models in the web viewer?

You cannot prevent it 100%, but you can make it more difficult. Technical measures: No download button, obfuscated asset URLs, streaming instead of local files, browser cache control. Organizational measures: Reduced models (not the original CAD), watermarks (traceability), NDA with customers, time-limited access. Reality: Technically skilled users can always extract the data (browser DevTools, screen recording). Strategy: Raise the barriers + legal protection (NDA) + reduced models (reverse engineering is not economical).

What is the difference between data security and data privacy?

Data security: Protects data from technical threats (hacking, loss, theft). Applies to all data (CAD, documents, customer data). Measures: encryption, backups, access control. Data privacy: Protects personal data (names, emails, IP addresses). Legal requirements (GDPR). Measures: consent, deletion, right of access. Overlap: Encryption protects against theft (security) and against privacy breaches (privacy). B2B context: CAD data = data security, user accounts = data privacy + data security.

Which certification should a 3D platform have?

It depends on the industry and the requirements. Minimum: ISO 27001 (internationally recognized). SaaS platforms: ISO 27001 + SOC 2 Type II (standard for cloud providers). Automotive: TISAX (in addition to ISO 27001). GDPR compliance: If you have EU customers, data storage in the EU. Other: ISO 27017 (cloud security), ISO 27018 (cloud privacy). Verification: Look at the certificates (not only marketing claims), request audit reports, validate data residency.

Can watermarks in 3D models be removed?

It depends on the watermark type. Metadata watermarks: Easy to remove (export the file again). Geometric watermarks: Difficult to remove (embedded in the geometry, minimal changes). Visual watermarks (real time): Only in the display, not in the model. Security: Geometric watermarks give the best traceability, but in theory you can also remove them (with much effort). Purpose: Deterrence + evidence in case of leaks (which source did the model come from?). Best practice: Watermarks + reduced models + NDA.

Industry Standards and Frameworks

Security standards: - ISO/IEC 27001 – Information security management system - SOC 2 – Service Organization Control - TISAX – Automotive information security - ISO/IEC 27017 – Cloud security - ISO/IEC 27018 – Cloud privacy

Encryption standards: - AES-256 – Advanced Encryption Standard - TLS 1.3 – Transport Layer Security - RSA 2048/4096 – Public key encryption

Best practices: - NIST Cybersecurity Framework – US standard - BSI IT-Grundschutz – German standard - CIS Controls – Center for Internet Security

Security concepts: - Data privacy (GDPR) – Privacy requirements - Access control – Access management - Encryption – Data encryption - Multi-factor authentication – Multi-step authentication - Zero trust architecture – Never trust, always verify

Cloud technologies: - Cloud security – Security in the cloud - SaaS security – Software-as-a-service security - Data residency – Data storage location - Hybrid cloud – Combined cloud and on-premise - Private cloud – Dedicated cloud environment

3D-specific topics: - 3D model – 3D data formats - CAD data management – Product data management - Digital twin – Digital twins - PLM security – Product lifecycle management security - IP protection – Intellectual property protection

Compliance: - ISO 27001 – Information security - SOC 2 – Service controls - TISAX – Automotive security - GDPR – Data privacy - NDA – Non-disclosure agreement

Backup and recovery: - Disaster recovery – Emergency recovery - Business continuity – Continuity of operations - Backup strategies – 3-2-1 rule - Ransomware protection – Protection against ransomware - Data loss prevention – Prevention of data loss