Encryption
All traffic between your browser or mobile app and BuilderSolve runs over TLS. Data is encrypted at rest on our database and file storage, including everything uploaded through daily logs, file management and chat.
Security
Your job costs are
Your job costs are
nobody else's business
Estimates, margins, payroll and client contracts all live in BuilderSolve. This page describes exactly how that data is protected — and, at the bottom, what we have not done yet.
Role-based access control
Every user is assigned a role, and roles determine what is visible. Field crews do not see margins. Clients see only their own jobs through the client portal. You control who is granted what, and can revoke access immediately.
Per-company isolation
Each company is its own tenant. Subcontractors who register as their own company keep their crews, rates and jobs separate from yours — they see the projects you share with them and nothing else.
Backups
Automated backups run on a recurring schedule so a bad import, an accidental deletion or a hardware failure does not cost you a project's history.
Infrastructure
Files are stored on Cloudflare R2. Our hosting and storage providers maintain their own SOC 2 Type II compliance for the infrastructure they operate. We target 99.9% uptime, as stated in our Terms.
Payment data
Card payments are processed by a third-party payment processor. Full card numbers are never stored on BuilderSolve servers. See our Privacy Policy for the full detail.
Your data
It stays yours
We do not sell your data, and we do not share it with other contractors. Your estimates, rates and client lists are not pooled into a benchmark product. You can export your data, and you can ask us to delete it — the process is set out in our Privacy Policy.
If you use the AI assistant, it operates on your company's data to answer your questions and draft records for your approval. It does not expose one company's data to another.
Reporting a vulnerability
If you have found a security issue, we want to hear about it before anyone else does.
- We acknowledge reports within two business days.
- Tell us what you found and how to reproduce it. Please do not access, modify or exfiltrate other customers' data while testing.
- We will not pursue legal action against researchers who report in good faith and give us reasonable time to fix the issue before disclosing it.
What we haven't done yet
Plenty of software companies imply certifications they do not hold. Here is where we actually stand, so you can ask your questions up front instead of finding out during procurement.
- Our own SOC 2 audit Not completed. Our infrastructure providers hold SOC 2 Type II for the layers they run, which is not the same as BuilderSolve holding one. If your procurement process requires a vendor SOC 2 report, talk to us about timing before you commit.
- ISO 27001 Not certified.
- Third-party penetration test Not yet published. When we have a report we can share under NDA, this page will say so.
- Public bug bounty No paid programme at this stage. The disclosure commitments above still apply to anything you report.
Got a security question
this page didn't answer?
Ask it before you migrate, not after. We would rather have the awkward conversation early.