SECURITY & TRUST

What is actually implemented.

Capital project data is commercially sensitive and frequently contested. Every control below exists in shipped code today. Where a control is not yet built, this page says so rather than implying it.

Request the security pack

Never used for trainingYour project data does not train foundation models. Committed contractually, and the platform is model-agnostic by design.

You choose the regionDeployment to EU, UK, US or a customer-nominated region, including your own VPC.

Every conclusion is auditableObservations, recommendations, approvals and executions are written to a hash-chained log with a verification endpoint.

IMPLEMENTED

Controls that exist in shipped code.

Everything in this section is running in the product today. It is the list we would walk a security reviewer through, line by line.

Identity and access

OIDC sign-in with PKCE, session refresh and provider sign-out (Construction Twin)
SCIM 2.0 user provisioning and de-provisioning (Construction OS)
TOTP two-factor enrollment to RFC 6238, compatible with standard authenticator apps
Role-based access control scoped to tenant, organization, project and record type
AI agents inherit — and cannot exceed — the permissions of their principal

Verifiable audit

Hash-chained audit records, making tampering detectable rather than merely discouraged
A verification endpoint that re-walks the chain and reports the first break
Every AI conclusion linked to the evidence set that was visible at the time
Exportable audit trail suitable for claims and dispute proceedings

Tenant and data isolation

Tenant, organization and project scoping enforced at the data-access layer
Generated assets served through authenticated, tenant-scoped delivery — no public static mount
Cross-tenant asset access is refused, and that refusal is covered by an automated test
Upload type, size, filename and checksum validation on ingest

Operations and recovery

Database and object-store backup, verification and restore utilities
Scheduled data-retention sweeps, plus an on-demand sweep for a data-subject request
Backup restore drills exposed as an operation, not left as a manual runbook step
Readiness and health endpoints, worker heartbeats, Prometheus metrics and optional OpenTelemetry export

Application hardening

Rate limiting keyed on a stable credential fingerprint, per caller
Request IDs and security headers on every response
Short-lived access tokens with refresh and session revocation
Continuous dependency scanning; typecheck, lint, unit tests and build gated in CI

Model handling

Customer project data is never used to train foundation models
Model-agnostic routing — no lock-in to a single provider or model generation
Self-hosted open-weight models available for restricted-data workloads
Every AI response reports whether it was model-backed, and by which provider and model

NOT YET BUILT

What we have not done.

Most vendors leave this section out. We would rather you learn it here than four meetings into a procurement process.

SAML 2.0 single sign-on

Not implemented. OIDC and SCIM are. If your identity platform requires SAML specifically, tell us during pilot scoping — it is a known gap, not a surprise.

SOC 2 Type II and ISO 27001

Neither certification is held today, and no audit is in progress. The controls above are designed to be auditable when we start, but we will not claim a programme we have not begun.

Third-party penetration testing

Not yet commissioned. Internal review, automated dependency scanning and CI gates are in place. An external test is planned before general availability.

Immutable audit storage

The audit chain makes tampering detectable. It does not make records immutable — WORM storage or an external notary would be required, and neither is in the product today.

Load and availability testing at scale

Load-testing tooling ships with the product, but published availability figures are operating targets rather than a measured or contractual SLA.

RESPONSIBLE DISCLOSURE

Found something? Tell us.

We investigate every credible report and will not pursue legal action against good-faith security research conducted within a reasonable scope.

SECURITY CONTACT506473839open@gmail.com

RESPONSE TARGET

Acknowledgement within 2 business days.

DOCUMENTATION

Architecture, DPA and sub-processor list available under NDA.