Security
Your bid prices, quantities and pay apps are the numbers your company runs on. This page covers how CivilVault keeps them yours, in plain terms. For what we collect and why, see the Privacy Policy.
Your company's data stays your company's
Every company's projects sit behind a wall enforced by the database itself, not only by what the screens show. Each request is checked against who is signed in, which company they belong to and which projects they're on. We test that boundary directly: a signed-in user at one company cannot read or change another company's records.
Who on your team sees what
- Owner — every project, plus company details, the team and the plan.
- Admin / Billing — every project in the company. Company details and the team stay with the owner.
- Project Manager — the projects they created or are assigned to.
Only an owner can invite or remove people or hand out the owner role, and nobody can raise their own access.
Accounts and sign-in
- CivilVault is invitation-only. There is no public sign-up; every account starts with an invite from your company's owner.
- Passwords are stored only as one-way hashes by our sign-in provider. Nobody at CivilVault can see them.
- Idle sessions end on their own: after 7 days on the web, or 30 days if you choose to stay signed in or use the phone app.
Files and documents
- Plans, photos, invoices and every other upload live in private storage. Nothing has a public address.
- Opening a file creates a link that works for one hour, issued only after your access to that project is checked.
- When you have CivilVault read a document — a bid tab, an engineer's estimate, a locate ticket — its contents are used only to return the fields you asked for. They are not used to train models.
Share links
- You choose what each link shows. Costs and dollar amounts stay hidden unless you turn them on.
- Links can expire on a date you set, can be revoked at any time, and show how many times they've been opened.
- Files on a shared page open through the same one-hour links as in the app.
Encryption and infrastructure
- Data is encrypted in transit and at rest.
- CivilVault runs on Supabase (database and sign-in) and Cloudflare (application hosting and file storage). The full list of service providers is in the Privacy Policy.
- The keys that can bypass access rules live only on our servers, never in the app your team loads.
What we don't do
- We don't sell your data or share it with advertisers.
- We don't open your project data unless you ask us to for support.
Your data, your call
Ask and we'll export your project data. Close your account and we delete it within 30 days, except records we're legally required to keep.
Report a problem
Found something that looks wrong? Email [email protected] with "Security" in the subject line. We'll reply quickly and keep you posted while we fix it. If we ever learn of a breach affecting your data, we will tell you promptly.