Hacker News Reader

Comment by newprint | Hacker News Reader

Ok, just a note to everyone ! It is online service and your diagrams are stored in the "cloud" and you have zero control over it. Please, do not post your company's secret in form of diagrams. Recently, we caught one of the contractors using Draw.io to make diagrams of brand new systems that we are designing(we are fortune 40 company). System is expensive, very sensitive.

View on HN

And where did the user store the data?

Addtionally, you can deploy a local version via docker, or use the stand-alone desktop version, https://github.com/jgraph/drawio has the links.

"cloud" != "public"

If you save it in your Google Drive, you can control who has access. Even better if it's your organization's GSuite

that is if you save it, it is my understanding the actual objects drawn and linked on screen are entirely stored in the DOM of your browser until you click "save" and send it to a cloud location. "saving" to your browser or device just creates a "download" of static blob data in a variable

i have confirmed this with a local instance of draw.io

> your diagrams are stored in the "cloud" and you have zero control over it

I made a diagram on Sunday and saved it to my local device without logging in; nothing stored in the cloud. Just opened it again from my local storage and it loaded into draw.io with no problem.

As David mentioned, check out the desktop app for local device storage at https://get.draw.io

Just out of curiosity can someone point me to the basis for the claim that diagrams are uploaded to some cloud storage? I've used the tool and had the impression that it was all client side in memory DOM stuff until I downloaded my diagram. I never looked if some of the content gets pushed elsewhere, how would I substantiate these claims?

Contractor could have saved diagrams generated to the cloud using any tool. Not sure what makes Draw.io worth calling out in that regard.

On the flip side, we use Google G Suite so the majority of our documents are stored with Google, and draw.io's cloud support seamlessly works with our G Suite drives.

Our G Suite administrators have plenty of control over the G Suite Google Drives that would be used with draw.io and our Google accounts.

The only bits of our data we don't trust with Google are PHI

This is where my reply was going. Authenication to Google Drive is client-side and direct to google.com. There is no draw.io server anywhere that can access your Google Drive.

Reply on news.ycombinator.com