# Security and privacy

This branch exists because security reviews are a real part of choosing software, and vague reassurance wastes everybody's time. Each page below answers one question precisely, including the ones where the honest answer is "yes, that leaves your site, and here is how to stop it".

If you only read one page, read [Security overview](https://help.gocapable.com/diagrams/security-overview.html). It is written to be forwarded.

---

## The short version

| **Question**                             | **Answer**                                                     |
| ---------------------------------------- | -------------------------------------------------------------- |
| Where is diagram source stored?          | In your Confluence site, as attachments and custom content     |
| Who can see a diagram?                   | Whoever can see the page. There is no second permission model  |
| What leaves the tenant?                  | Text diagram source for rendering, and whatever you send to AI |
| Can we stop that?                        | Yes: self-host the renderer, and switch AI off                 |
| Do draw.io and Excalidraw send anything? | No. They render entirely in the browser                        |

---

## Every answer in detail

[Security overviewA one page answer for a security review: where diagram data lives, what leaves your tenant, and the switches.](https://help.gocapable.com/diagrams/security-overview.html)[Where diagrams are storedDiagram source is kept in your Confluence site as page attachments and app content, not in our database.](https://help.gocapable.com/diagrams/where-diagrams-are-stored.html)[draw.io XML inside PNG filesdraw.io diagrams keep editable XML inside the PNG itself. What that means for sharing and re-opening.](https://help.gocapable.com/diagrams/draw-io-xml-inside-png-files.html)[Stored previews and thumbnailsIndexing attaches a rendered SVG preview to each diagram so pages and logged out readers can show it.](https://help.gocapable.com/diagrams/stored-previews-and-thumbnails.html)[What leaves your Confluence siteWhich languages render in the browser, which send source to the render service, and what AI and Rovo receive.](https://help.gocapable.com/diagrams/what-leaves-your-confluence-site.html)[Domains we connect toThe exact hosts Capable Diagrams connects to from the browser and the backend, and what each carries.](https://help.gocapable.com/diagrams/domains-we-connect-to.html)[Customer managed egressApproving your own domain means the browser fetches it directly, which is faster but skips the proxy guards.](https://help.gocapable.com/diagrams/customer-managed-egress.html)[Anonymous and guest viewersLogged out readers never get an API token, so text diagrams come from the stored preview attachment.](https://help.gocapable.com/diagrams/anonymous-and-guest-viewers.html)[Scopes and permissionsThe Forge scopes the app requests, what each is for, and why stripping its space permissions breaks it quietly.](https://help.gocapable.com/diagrams/scopes-and-permissions.html)[AI and your diagram dataWhat is sent when you generate, edit or ask about a diagram, and the one switch that stops all of it.](https://help.gocapable.com/diagrams/ai-and-your-diagram-data.html)[Hosting and data residencyWhere the Capable Diagrams services run and where to find our current trust and compliance documents.](https://help.gocapable.com/diagrams/hosting-and-data-residency.html)

---

## Related

[AdministrationThe switches that change these answers.](https://help.gocapable.com/diagrams/administration.html)

[ReferenceEngines, limits and file handling.](https://help.gocapable.com/diagrams/reference.html)

[IntegrationsHow diagrams behave on published sites.](https://help.gocapable.com/diagrams/integrations.html)

---

_Precise beats reassuring._