Security & Compliance

HMI Library serves engineers who work on operational technology, and it is run by one automation technician (Pau Serrano García, sole trader) rather than a company with a security department. That is exactly why this page is written in plain language: below is where your data lives, who sees it, what becomes public when you publish a symbol, and how to reach me if something feels off.

What we store about you

• Account data: email, name, optional company / VAT ID. Stored in PostgreSQL on Supabase EU (Frankfurt).
• Payment data: handled entirely by Stripe. We never receive your card details, expiry, CVV — Stripe gives us a customer ID and a subscription status. Stripe is PCI-DSS Level 1 certified.
• Download log: which symbol you exported (official icon or community symbol), in which format, timestamp. Used to count your monthly download quota and for the usage stats in your dashboard. Kept 12 months for quota enforcement and abuse prevention, then anonymised.
• Symbols you save in the Symbol Builder: the editable model and the clean SVG/PNG. Private until you publish them; stored in a private storage bucket and served only through short-lived signed URLs.
• Community content: symbols you publish (title, description, category, tags, files, preview, automatic ISA-101 check result), your public profile (username, display name, avatar, bio, website), likes and comments, forum topics and replies. This is public by design — see below.
• Reports: if you report a symbol, comment or forum post — the target, your reason and your user ID. Not public; read by the admin only.
• Email opt-in (optional): if you grab the cheat sheet lead magnet. Marketing emails only sent if you tick the consent box.

What we do NOT store

• Any SCADA / PLC / HMI runtime data. The Symbol Builder and both libraries are design-time only — your tags, screens and PLC configs never leave your network. A symbol is a drawing; nothing connects to your plant.
• Your customer data, project files, or anything proprietary to your end customer. If you draw a client-specific symbol, keep it private (do not publish) and it stays in your account only.
• Plaintext passwords. Authentication via Supabase Auth — bcrypt-hashed passwords, OAuth via Google.
• Card details or financial data. All payment flows redirect to Stripe Checkout / Stripe Customer Portal.

What is public when you publish

HMI Library includes a community library and a forum. Anything you publish there is visible to anyone on the internet without an account, may be indexed by search engines, and — for symbols — is licensed under CC BY 4.0:

• Published symbols at /s/your-symbol: preview, title, description, category, tags, the ISA-101 check result, the publication date and your username as author. The clean SVG/PNG is only delivered through the download endpoint (quota-gated), never as a public file.
• Your profile at /u/your-username: username, display name, avatar, bio, website and your published symbols (with like and download counts).
• Comments, forum topics and replies, with your username and date.

Your email, billing data, download history, private symbols and reports are never public. You can unpublish (make private) or delete your own symbols from the dashboard at any time; the Privacy Policy has the full list and the Community Guidelines cover what to publish and how takedowns work.

Where data lives

GDPR & your rights

Pau Serrano García (sole trader, trading as HMI Library) is the Data Controller. You have the right to:

• Access: request a copy of all data we hold about you.
• Rectify: change anything inaccurate (most fields self-service from your dashboard and profile settings).
• Erase: delete your account and all associated data. Email hello@hmilibrary.com; full deletion within 30 days. Published symbols are removed from the site; copies others already downloaded under CC BY 4.0 remain licensed, as the licence is irrevocable.
• Port: receive your data in a machine-readable format, including the symbols you created.
• Object: opt out of marketing or processing not strictly necessary for the service.

See the Privacy Policy for the formal version with subprocessor list.

Authentication & access control

• Email + password (bcrypt) or Google OAuth.
• Session tokens via Supabase Auth — JWT short-lived + refresh.
• Rate limiting on signup and signin endpoints.
• Generic error messages to prevent email enumeration ("Invalid credentials" — same response for unknown email vs. wrong password).
• Minimum password length 10 characters at signup.
• Download quota enforced server-side: every clean export goes through a backend function that checks your plan and the month's count before issuing a signed URL. The browser never receives a clean file without it.
• Moderation: published content can be hidden or removed by the admin; accounts that breach the guidelines can be suspended. Reports go straight to my inbox.

Subprocessors

We use a deliberately small set of well-vetted vendors:

• Supabase Inc. (US, EU subsidiaries) — database, auth, file storage, edge functions. Data residency: EU.
• Stripe Payments Europe Ltd. (Ireland) — payment processing.
• Cloudflare Inc. — CDN, DNS and server-side rendering of public pages (no user data persisted).
• Google Workspace — operational email (hello@hmilibrary.com).

We do not use third-party analytics on the marketing site (no Google Analytics, no tracking pixels).

Reporting a vulnerability

Found something? Email security@hmilibrary.com with details. I respond within 72 hours and credit reporters in the changelog (with permission). No bounty program currently — one-person operation — but I am respectful and grateful, and fixes ship fast because there is no committee.

What's NOT certified yet

Honest disclosure:

• We're not SOC 2 Type II — too early-stage to justify the audit cost. Will be scheduled if Enterprise demand pulls it.
• We're not ISO 27001 — same.
• We don't currently offer SSO / SAML — Google OAuth is available on every plan; SAML is on the Enterprise roadmap.

If your procurement requires any of these and we're a strong fit otherwise, email us — we're happy to commit to a timeline.

Changelog

August 2026: Community library, public profiles, comments and forum added; documented what is public when you publish, the storage buckets for symbol files and the server-side download quota. Download-log retention aligned with the Privacy Policy (12 months). Document version 1.1.

April 2026: Page published. Document version 1.0.