The ledger belongs to the owner. Everyone else reads under a grant.
Owners ask four questions before they buy: where the data lives, who can read it, whether they can get it out, and what happens when someone leaves. The answers are below, in that order.
Where the data lives
In the United States. The server is in North Carolina and the hosting provider holds its own copies in Boston. Nothing is stored, processed or backed up outside the United States, and connections are encrypted. Uploaded documents sit outside the part of the server the web can reach, so no document is addressable by guessing a link. We also take our own copy of the database every night, kept for thirty days, with the packed documents kept for seven. Every copy is read back and checked before any older copy is removed, and a copy that fails that check is deleted rather than counted. Choosing a different region is not offered in version one. If your security review needs a written statement about encryption at rest, ask us and we will get it from the provider rather than assert it here.
Who can read it
Only people the owner has granted access to, on the projects named in the grant, at the scope named in the grant. There are two scopes and no more, on purpose. Team reads and writes the registers and reaches the documents and the messages. Guest reads the position and the executed record, and never the working file, the documents behind a draw or the messages. Our own staff read a project only during baseline setup and senior review, and that access is logged.
Export at any time
Every baseline version and its lines, the ledger, the change orders, the buyout, the allowances, every audit table and every stored month end download as CSV from inside the project, on their own or as one archive. No request, no waiting period, for the life of the subscription and after it ends, with no time limit.
Access is a grant, not ownership
An owner's representative, a lender, an investor or counsel reads the ledger because the owner granted it. The owner revokes the grant at any time and the history stays with the owner. When an owner's rep engagement ends, the rep loses access and the owner keeps everything.
Documents
Supporting documents are stored outside the web root and served only to a signed in user with membership on that project. File types are checked, sizes are capped, stored names are randomized.
Accounts and sign in
Each person has their own account. Passwords are hashed, sign in is rate limited, and every state changing action requires a fresh session token. Administrative rights are set by us directly, never inferred from an email address.
What is logged
Sign ins, grants and revocations, baseline versions, and every change to a cause classification with the user and the timestamp. The audit table is part of the export.
What is not connected
Nothing. No integration with Procore, Autodesk or any contractor platform in version one. Data enters from the documents the owner already receives. That is a design choice: the second ledger is independent of the first.
Anonymous calculator data
The free calculators run in your browser, and nothing you type leaves it while you are using them. If you ask a tool to send you the result, then the figures you entered, the result itself and your email address are sent to us, because there is no other way to put them in the message. They are used to send you that result and to answer you, and for nothing else.
Incident handling
If a security incident affects an owner's data, that owner is notified by email within seventy two hours of confirmation with what happened, what was affected and what was done. Questions go to the address in the footer.
Questions owners ask
Who owns the data?
The owner who holds the project. Not the contractor, not the owner's rep, not us. Every other party reads under a grant the owner can revoke.
Can I get everything out?
Yes, at any time, as structured files: every ledger, every version of the baseline, the audit table, and every generated report. The export stays available after the subscription ends, with no time limit.
Do you integrate with the contractor's system?
No. Nothing connects to Procore or any contractor platform in version one. Data enters from the documents the owner receives.
Can I sign a data processing agreement?
Yes. Ask on the contact page and we send the current agreement with the security summary.
Questions kept with the project, not in an inbox 28 s, no voice over. Nothing loads from YouTube until you press play.All eleven films
Ask the security questions on the call.
Thirty minutes. We show where the data lives, how a grant works, and the export, on a fictional project.