Back to AI Tools
tldraw
Risk Overview
Moderate Risk
3.6
/10
UI Design
·
Top Risks
No formal security certifications for cloud product; unclear data retention policy; no explicit GDPR documentation; US CLOUD Act exposure for cloud-stored whiteboard data.
Mitigations
Self-host using open-source release to avoid cloud data concerns; use tldraw SDK in your own infrastructure for full data control; open-source codebase allows independent security audit.
Get started
Is your team using
tldraw
safely?
Highest Risk Categories
The highest-scoring risk categories identified in this assessment.
Data Retention
No public data retention schedule found for tldraw.com cloud. Whiteboard snapshots and assets persist in Cloudflare R2. Deletion upon account removal not explicitly documented. Absence of a clear retention/deletion SLA is a moderate risk.
5
/10
Security Posture
No SOC 2 or ISO 27001 certification publicly documented for tldraw cloud. Open-source codebase is publicly auditable. Infrastructure uses Cloudflare (which has its own security certifications). No known major breaches. No bug bounty program advertised. Moderate risk due to absence of formal certifications.
5
/10
Data Sovereignty
tldraw Inc. is a US company (incorporated in GB per trademark docs, US operational HQ). Cloud data stored on Cloudflare infrastructure which is US CLOUD Act-exposed. GDPR compliance not explicitly documented. Self-hosting available to mitigate.
4
/10
Unlock the complete assessment
Run a free assessment to access the full AI tool risk analysis.
Updated July 2026 • AI-assisted research • Reviewed by Verax • Report an issue
Reference Documentation
Official documentation and policies referenced as part of this assessment.
Terms of Service
https://tldraw.dev/legal/tldraw-license
Privacy Policy
https://tldraw.dev/legal