The ledger belongs to the owner. Everyone else reads under a grant.
Owners ask four questions before they buy: where the data lives, who can read it, whether they can get it out, and what happens when someone leaves. The answers are below, in that order.
Where the data lives
On managed cloud infrastructure in the United States, in a single region, with encrypted storage and encrypted connections. Backups are taken daily and kept for thirty days. Data residency outside the United States is not offered in version one.
Who can read it
Only people the owner has granted access to, on the projects named in the grant, at the role named in the grant: full, read only, or summary. Summary scope shows headline figures and the report without contingency detail, change order detail or the audit table. Our own staff read a project only during baseline setup and senior review, and that access is logged.
Export at any time
Every ledger, every baseline version, the audit table and every generated report export as structured files on demand, for the life of the subscription and for sixty days after it ends. No request, no waiting period.
Access is a grant, not ownership
An owner's representative, a lender, an investor or counsel reads the ledger because the owner granted it. The owner revokes the grant at any time and the history stays with the owner. When an owner's rep engagement ends, the rep loses access and the owner keeps everything.
Documents
Supporting documents are stored outside the web root and served only to a signed in user with membership on that project. File types are checked, sizes are capped, stored names are randomized.
Accounts and sign in
Each person has their own account. Passwords are hashed, sign in is rate limited, and every state changing action requires a fresh session token. Administrative rights are set by us directly, never inferred from an email address.
What is logged
Sign ins, grants and revocations, baseline versions, and every change to a cause classification with the user and the timestamp. The audit table is part of the export.
What is not connected
Nothing. No integration with Procore, Autodesk or any contractor platform in version one. Data enters from the documents the owner already receives. That is a design choice: the second ledger is independent of the first.
Anonymous calculator data
The free calculators store their inputs and results anonymously so the tools can be improved. No personal data is attached unless the user asks for the PDF and enters an email, and that email is used to send the PDF and for nothing else without consent.
Incident handling
If a security incident affects an owner's data, that owner is notified by email within seventy two hours of confirmation with what happened, what was affected and what was done. Questions go to the address in the footer.
Questions owners ask
Who owns the data?
The owner who holds the project. Not the contractor, not the owner's rep, not us. Every other party reads under a grant the owner can revoke.
Can I get everything out?
Yes, at any time, as structured files: every ledger, every version of the baseline, the audit table, and every generated report. The export stays available for sixty days after the subscription ends.
Do you integrate with the contractor's system?
No. Nothing connects to Procore or any contractor platform in version one. Data enters from the documents the owner receives.
Can I sign a data processing agreement?
Yes. Ask on the contact page and we send the current agreement with the security summary.
Ask the security questions on the call.
Thirty minutes. We show where the data lives, how a grant works, and the export, on a fictional project.