Does Your AI Drawing Review Vendor Train on Your Drawings?

How should you use this list?

Send all 20 questions to every vendor on the shortlist and ask for each answer with a link or a document. An answer that only exists on a call counts as missing. The method for sorting answers into documents and promises is on what a security questionnaire should get back, and the shorter category checklist is in is AI drawing review software secure.

Helonic's answers below quote its security page, AI policy, privacy policy, terms, and published facts, as of October 2026. Where Helonic does not publish an answer, the entry says so and points to founders@helonic.com, the contact on its security page.

Model training: do our drawings teach anyone's model?

Start here. A training answer cannot be undone after the set is uploaded, so it decides whether the rest of the list matters.

1. 1. Are our drawings used to train or fine-tune your AI models?

   Why it matters: A drawing that trains a shared model can shape what other customers see, and no deletion request pulls it back out.

   Helonic's answer: No. Helonic's AI policy states that customer data is not used to train or fine-tune AI models.

   Source: AI policy

2. 2. Do the third-party AI providers you call train on our drawings?

   Why it matters: A vendor's own promise covers its own models, and the model provider behind it needs its own answer.

   Helonic's answer: Helonic's AI policy says third-party AI and cloud providers are evaluated for security posture, privacy controls, and contractual data-use commitments aligned to enterprise customer requirements. The provider names are not published on the site; ask in writing.

   Source: AI policy

3. 3. Where is the no-training commitment written down, and how do we know when it changes?

   Why it matters: A sentence on a web page can change without notice unless it is versioned or repeated in your contract.

   Helonic's answer: It is in Helonic's AI policy, version 1.0, effective March 23, 2026. The policy says it is reviewed at least annually and whenever AI usage or infrastructure changes materially, and that revisions are versioned. Ask for the same sentence in your agreement.

   Source: AI policy

4. 4. Does the AI make decisions on its own, or does a person check each finding?

   Why it matters: An unreviewed finding pushed into Procore becomes a record your team has to answer for.

   Helonic's answer: Helonic's AI policy calls findings decision-support signals that qualified personnel review and validate. A reviewer accepts or edits each finding before anything is created in Procore or Autodesk Construction Cloud.

   Source: AI policy; Helonic facts

Retention and deletion: how long does the set stay?

Owner-confidential sets usually come with their own retention clause. These four questions tell you whether the vendor can meet it.

1. 5. How long do you keep our drawings and findings?

   Why it matters: Your owner contract may set a retention limit that passes down to every tool that holds the set.

   Helonic's answer: Helonic's privacy policy says data is kept as long as necessary to provide the service. No fixed number of days is published. Backups are automated and redundant. Ask how long backups are kept. Put the days you need in the order form.

   Source: Privacy policy; Security

2. 6. Can we delete a project's drawings before the contract ends?

   Why it matters: Projects close and owners ask for files back long before a subscription renews.

   Helonic's answer: Yes. Helonic's privacy policy says it will delete or anonymize data on request, unless it is required to keep it for legal or compliance purposes.

   Source: Privacy policy

3. 7. What happens to our data when the subscription ends?

   Why it matters: Silence on this point means drawings can sit in a vendor's storage long after anyone is paying attention.

   Helonic's answer: Helonic's terms say data may be deleted under its retention policy after termination. Export what you need before the end date and ask for written confirmation of deletion.

   Source: Terms of service

4. 8. Can we export our data in a format we can keep?

   Why it matters: Findings that only live inside the vendor's app are lost the day access ends.

   Helonic's answer: Helonic's privacy policy lists the right to export your data in a portable format.

   Source: Privacy policy

Access and sharing: who can open the set?

Ask who on the vendor side can open a file, how they sign in, and where that access is recorded.

1. 9. Who at your company can open our drawings?

   Why it matters: Vendor staff with open access to customer storage are a direct path for a confidential set to be seen by people outside the project.

   Helonic's answer: Helonic's security page says access to production systems and customer data is limited to authorized personnel on a need-to-know basis, reviewed regularly, and revoked promptly when no longer required.

   Source: Security

2. 10. Is access logged, and is multi-factor authentication required?

   Why it matters: Without a log, nobody can say after the fact who opened a sheet.

   Helonic's answer: Helonic's security page says multi-factor authentication is required for critical systems, audit logs are kept for access to sensitive systems and data, and alerts notify the team of anomalous activity.

   Source: Security

3. 11. Can we sign in through our own identity provider?

   Why it matters: IT usually requires SSO before a company-wide rollout so that a departing employee loses access in one place.

   Helonic's answer: Helonic's Enterprise plan lists SSO and SAML.

   Source: Pricing

4. 12. How is our data encrypted?

   Why it matters: "Encrypted" with no standard named has not answered the question.

   Helonic's answer: Helonic's security page states TLS 1.2 or higher in transit and AES-256 at rest. Secrets and API keys are kept in a dedicated secrets management system and never stored in plaintext.

   Source: Security

Subprocessors and model providers: who else touches the files?

Every cloud host and model provider in the chain handles the files at some point. Vague answers tend to collect in these rows.

1. 13. Which subprocessors and AI model providers process our drawings?

   Why it matters: Your security team cannot assess a provider it has never been told about.

   Helonic's answer: Helonic's AI policy says it may use vetted third-party AI and cloud providers for model execution and platform operations, and that its infrastructure is cloud-hosted with managed cloud services for database and deployment. The named list is not published on the site; ask for it in writing.

   Source: AI policy

2. 14. How do you vet those providers?

   Why it matters: A named list is only useful if someone checked what each provider is allowed to do with the data.

   Helonic's answer: Helonic's AI policy says providers are evaluated for security posture, privacy controls, and contractual data-use commitments, and that vendor oversight is part of its AI governance across engineering, product, and security leadership.

   Source: AI policy

3. 15. Where is our data stored and processed?

   Why it matters: Public-sector and some private owners restrict which countries can hold their drawings.

   Helonic's answer: Helonic's privacy policy says information may be processed in countries other than your own, with safeguards in place. Specific hosting regions are not published; ask in writing. The Enterprise plan lists on-premise deployment.

   Source: Privacy policy; Pricing

Certifications and incident response: what is verified, and what happens if it fails?

A certification tells you someone outside the company checked the controls. The incident answer tells you what happens on the bad day.

1. 16. What security certification do you hold?

   Why it matters: A third-party assessment is the difference between a checked claim and a self-reported one.

   Helonic's answer: Helonic's security page states that Helonic is SOC 2 compliant, with controls independently assessed against the SOC 2 Trust Services Criteria for security. The report itself is not published; ask whether it can be shared under NDA.

   Source: Security; Helonic facts

2. 17. What happens if our data is involved in a security incident?

   Why it matters: The notice period in your owner contract only works if your vendor's notice reaches you first.

   Helonic's answer: Helonic's security page says it keeps an incident response process and will investigate promptly and notify affected customers in line with applicable law and its contractual commitments. A specific notice period is not published, so write the one you need into the agreement.

   Source: Security

3. 18. How do we report a vulnerability or a security concern?

   Why it matters: A vendor with no reporting address has no way to hear about problems before attackers do.

   Helonic's answer: Helonic's security page directs vulnerability reports and security concerns to founders@helonic.com. It also says code changes are reviewed before deployment and dependencies are monitored for known vulnerabilities.

   Source: Security

Contract terms: what does the agreement say?

Every answer above should be repeatable in the agreement. These two rows are where counsel usually starts.

1. 19. Who owns the drawings we upload, and what license do you get?

   Why it matters: An open-ended license on uploaded content can outlast the project and the subscription.

   Helonic's answer: Helonic's terms say the customer keeps ownership of the drawings and content it uploads, and Helonic gets a license to use, store, and process that content solely to provide the service. Address ownership of findings in the order form.

   Source: Terms of service

2. 20. What uptime do you commit to, and how will we hear about changes to the terms?

   Why it matters: A review tool that is down during a bid week costs a team the time it was bought to save.

   Helonic's answer: Helonic's terms say it aims for 99.9% uptime without guaranteeing it, and that material changes to the terms are announced by email or in the product. The Enterprise plan lists SLA guarantees.

   Source: Terms of service; Pricing

What does Helonic publish, and what do you have to ask for?

Six rows carry most of the risk. The middle column is on Helonic's public pages today. The right column is what to request from founders@helonic.com before the first upload.

Get the right column back before anyone signs the approval. A pilot can sometimes clear on the published answers. A company standard should wait for the documents.

Where do these answers go next?

Training and retention answers belong in the contract, which is covered in what legal wants in an AI drawing review contract. Deletion at the end of the term is on what happens to drawings when the subscription ends. If two vendors are still in the running, line their answers up with how to compare two vendors' security answers.

Security is one of five criteria in what to look for in an AI construction drawing review platform. What the tool does with a set once it is uploaded is explained in AI for construction drawings, and the product itself is on AI document review. The blockers IT raises before a rollout are listed in what IT will block in an AI drawing review rollout.

Before you upload, read the overview of how AI reviews construction drawings so the team knows which sheets the model reads and which ones a reviewer still checks by hand.

Frequently Asked Questions