Security
Your plans are your IP. We treat them that way.
Every layer of the platform — auth, storage, access, audit — is built so that only the right person sees the right document at the right time, and so that builders always know who looked at what.
Encrypted in transit + at rest
TLS 1.3 from your browser to our edge. AES-256 for everything stored. Managed via Supabase's SOC 2 Type II–certified infrastructure.
Tiered document access
Project files are split into preview and full tiers. Full plans require both verified credentials and a submitted bid or signed NDA.
Row-level security
Policies in the database enforce that builders only see their projects, vendors only see bids they submitted, strangers see nothing. Client bugs cannot leak data.
Full audit log
Every signed URL, every document view, every credential decision is written to an immutable log readable by the project owner.
Verified vendors only
License and insurance are reviewed by admins before a vendor gets a verified badge. Expirations are tracked; badges revoke automatically.
IP-protective terms
The Terms of Use grant vendors a narrow, revocable license to view plans for bidding only. Sharing or reusing plans is a breach we can enforce.