Security

Every table that holds your data enforces Row Level Security at the database level — access is checked by the database itself on every query, not just by application code. We run an automated test that creates two separate companies and verifies neither can read, write, or delete the other's data across every table, and we run it again whenever the schema changes.

Deletions and decisions about money and access — who removed a drawing set, who took scope out of a bid, who changed somebody's role — are written by the database itself as they happen. Nobody using the product can create, alter or delete one of those entries, including the account owner, because the permission to do so does not exist anywhere in the API. Owners and managers can read the record and export it.

Who may see margin, pay rates, payments received or the audit log is decided by the database on every query — not by hiding a button. On the Business plan you can build your own roles on top of the built-in four; ownership itself is deliberately not grantable, because a role that could define roles could give itself every permission in the account. Automated tests create a role, grant it exactly one thing, and verify it is refused all the others.

Sign-in is handled by Supabase Auth (email/password and Google). Server-side credentials — including the key that can bypass tenant isolation for administrative tasks — are stored only in server environment variables, never in the database and never shipped to your browser.

Your subscription is billed through Stripe Checkout — we never see or store your card details. Separately: PreConstruct AI does not process payments between you and your clients. We never collect bank account numbers, routing numbers, or any payment credential for that purpose — your payment instructions to clients are plain text you write yourself.

We rely on Supabase (database, authentication, file storage and the email that confirms your address), Stripe (billing), Vercel (hosting, and a cookieless count of visits to the public pages), Resend (the email the product sends), Google Workspace (our own mailbox), Anthropic (the AI that reads the drawings), Intuit QuickBooks (only for a company that connects it) and Google Ads (measuring our ads, on the pages outside your account only) — the same list as the Privacy Policy. Uploaded documents are not used to train third-party models.