Sketch documents are private by default. To access a private document, you need to have a Sketch account and be invited by someone who already has access to that document.

You can also decide to make your document viewable by anyone with the link and allow others to download it. You can set different access levels for everyone you invite to your document.

We don’t process or store payment data ourselves, but with our payment providers who are are PCI compliant. Learn more about Stripe and FastSpring’s security and compliance measures.

Sketch and our payment providers are hosted on Amazon Web Services, which holds multiple certifications for its data centers — including ISO 27001 compliance, PCI Certification, and SOC2 Certification. Learn more at AWS Security and AWS Compliance.

Both our in-transit and at-rest data are encrypted. That includes data in our database, underlying storage, backups, replicas, and snapshots. When we transfer data, we rely on HTTPS with TLS 1.2 or better.

All our servers are protected within our own Virtual Private Cloud (VPC), which is only accessible through secure connections and strict network Access Control Lists.

Our privacy policies adhere to the European Union General Data Protection Regulation (GDPR) and to the UK GDPR standards. We uphold those standards and apply them to all of our customers — including those outside of the EU.

For more information on how we collect and process data, please refer to our Data Processing Addendum and to our Privacy Statement. Learn more by reviewing our Terms and Policies.

We use a number of sub-processors to improve our services to you.

View a full, up-to-date list of sub-processors.

The specifics of data processing — such as its scope and purpose — are governed in our standard Data Processing Addendum (DPA), which is an attachment to our Terms of Service.

We have an in-house security team that looks after security on all levels — from our product and infrastructure, to our team.

We grant employees internal access to Sketch’s system and data on a case-by-case basis, through a strict access request procedure. We only give access to the specific information they need — and we continually review their access.

Every member of our team also participates in mandatory yearly security awareness training. We also train new joiners to make sure they align with Sketch’s understanding and value of security.

We conduct at least one external penetration test per year to detect and address any potential vulnerabilities. We also encourage public bug bounties to identify and report any potential security concerns via our Responsible Disclosure Policy.

Finally, we also run an ongoing research program where we invite ethical hackers to detect risks or issues within defined contexts. This enables us to monitor and fix their findings year-round.

You can review our full list of security measures to learn more.