Security
Practical controls for your workspace.
Access by company and role
Server-side checks restrict requests by company and role. Field and contractor access is limited to assigned projects. Customer accounts have a separate shared-record view. Owners can review team access in Company & team.
Shared documents
Shared links use random tokens and expiry dates and can be revoked by the company. Staff previews are read-only and are not counted as customer views. Document versions and signing evidence are retained for audit history.
Account and file protection
Passwords are hashed and authenticated sessions expire. Optional authenticator-based two-factor sign-in includes single-use recovery codes. Enable it from your profile. The site uses HTTPS and browser security headers. File access checks run on the server. Pending offline uploads are stored on the device; avoid using shared devices for private project files.
Report a concern
Use Contact and select Security. Describe the affected page and how to reproduce the issue without sending credentials or another customer’s private information. No system can promise perfect security; these controls are not a claim of independent certification.