Security & Procurement
How We Protect Your Records, And How To Buy From Us
The platform we deliver on holds your building records and the documents behind them. This page lists what protects them, what is not available yet, and what a purchasing office needs from us.
Each safeguard below describes the software as it runs today. Where something is still planned, we say so.
Protection
How Your Data Is Protected Today
Six safeguards built into the software, each in plain words.
- Each Organization Is Kept Apart
- One organization can never see another’s data. The database enforces this on every table, not only on the screens.
- Four Access Roles
- Owner, admin, member and a read-only viewer. The database enforces each role, so a viewer can read the plan but cannot change it.
- Private Document Storage
- The reports and files you upload are kept in private storage. Only signed-in members of your organization can get a link to them, and every link expires.
- Familiar Sign-In
- People sign in with a Google or Microsoft account, or with an email and password.
- Browser Protections
- Every page of the application forces an encrypted connection, limits which scripts may run, and refuses to load inside another site’s frame.
- Error Monitoring
- Application errors are reported to an error-monitoring service, so we see a fault when it happens rather than when someone tells us.
The outside services that host, store or process data for us are listed, with what each receives and where it operates.
See our subprocessorsOn Our Roadmap
What Is Not Available Yet
Security reviews often ask for these three. None is in the software today. If your review requires one, tell us early and we’ll say plainly where it stands.
Not available yet
Single Sign-On (SSO)
Signing in through your organization’s own identity provider. Today people sign in with Google, Microsoft or an email and password.
Not available yet
An Audit Log Of Changes
A record an administrator can review of who changed what, and when.
Not available yet
Multi-Factor Sign-In
A second step at sign-in, such as a code sent to a phone.
Procurement
Buying From Us
We work through your normal purchasing process, whether that is a formal solicitation or a scoped proposal for one engagement.
Contact us for our capability statement- Solicitations
- We respond to requests for qualifications (RFQs) and requests for proposals (RFPs).
- Documents
- Capability statement, W-9 and certificate of insurance available on request.
- Pricing
- By scope: how many buildings, which engagements, and how complete your records are. Set out in the proposal.
- Accessibility
- We design this website to the Web Content Accessibility Guidelines (WCAG) 2.1, level AA.
Policies
Report A Problem, Or Read The Fine Print
If you find a security issue, our disclosure policy explains how to report it and what happens next. The rest of our policies are linked here too.
Report An Issue
Responsible Disclosure
How to report a security issue to us, what is in scope, and what to expect after you report.
Providers
Subprocessors
The outside services that process data for us, what each receives and where it operates.
Privacy
Privacy Policy
What we collect, why we collect it, and the choices you have.
Terms
Terms Of Service
The terms that govern use of the platform, your account and your data.
Cookies
Cookie Policy
The cookies this website uses, which stay off until you opt in, and how to change your choice.
Have A Security Or Procurement Question?
Send it with your message, along with any questionnaire your review uses. We’ll answer it in writing.
Contact Us