Security

1. The Short Version

• Encrypted both waysTLS on every connection, and encryption at rest on the database and the file store.
• Scoped accessYour project data is reachable by your workspace. Inside BuiltUp, only a named few can reach production, and only with a reason.
• Your files stay your filesDrawings and site photos go to private object storage. Nothing is public by default and nothing is shared with other customers.
• No AI training on your workDocuments, drawings and voice notes are sent to OpenAI to be processed and returned. They are not used to train models.
• Known processors, listedEvery third party that touches customer data is named on the sub-processors page, with what it does and where.
• Certification status, stated plainlyNothing is certified yet. A penetration test and Cyber Essentials are under way, SOC 2 and ISO 27001 are planned, and this page says which is which.

2. Encryption

Every connection to BuiltUp runs over HTTPS with TLS 1.2 or better. That covers the marketing site, the web app, the mobile apps and the API. Plain HTTP requests are redirected, not served.

At rest, the PostgreSQL database is hosted on Supabase and is encrypted on disk. Files you upload sit in Amazon S3 with server-side encryption enabled. Backups carry the same encryption as the source.

Passwords are never stored as passwords. They are hashed with a slow, salted algorithm, so a copy of the table is not a copy of anyone's login. Payment card numbers never reach our servers at all: Stripe, Apple and Google handle the card and return a token.

3. Who Can See Your Data

Inside your workspace, you decide. Owners and admins manage who is invited, what role they hold and what they can open. Client and subcontractor portals show only the project they were invited to.

Inside BuiltUp, production access is held by a small number of named engineers, and it is not a standing permission for browsing customer projects. It is used for three reasons and no others:

• You have asked us to look. A support ticket where you want us to see what you are seeing.
• Something is broken. Investigating a fault, a failed upload or a job that did not run.
• The law requires it. A valid, binding request from a public authority, which we will tell you about unless we are prohibited from doing so.

We do not read your quotes to benchmark your rates, we do not sell aggregated pricing data, and we do not hand your client list to anyone. If we ever want to use anonymised, aggregated figures for a published report, we will ask first.

4. Tenant Separation

BuiltUp is multi-tenant. Every firm gets a workspace, and every record we store carries the workspace it belongs to. Queries are filtered on that identifier at the database layer rather than only in application code, so a request for a record outside your workspace returns nothing instead of returning someone else's job.

Uploaded files follow the same rule. Objects are namespaced per workspace and served through short-lived signed URLs, so a link that leaks out of an email expires rather than staying open. There are no shared, guessable file paths.

5. Sign-in and Sessions

• Google and Apple sign-in. If you use these, we never see the password. The provider authenticates the user and returns a verified identity.
• Email and password. Passwords are hashed and salted. Reset links are single use and time limited.
• Sessions. Signed JWT sessions with a limited lifetime and refresh. Signing out ends the session on the device.
• Roles. Permissions are checked on the server for every request. Hiding a button in the interface is not how we enforce access.

If a member of your team leaves, remove them in your workspace settings and their access ends. Removing a user does not delete the work they produced, so estimates and site records stay with the project where they belong.

6. Drawings, Photographs and Documents

Drawings, specifications, schedules of work, site photographs and exports are stored in Amazon S3 in a private bucket. Nothing is world readable. Access is granted per object, per request, through a signed URL that expires.

When a document or a drawing is analysed, a copy of the relevant content is sent to OpenAI for processing and the result comes back into your project. See section 7 for what that means in practice.

Deleting a file in the app removes it from your project immediately and clears it from storage in the ordinary course of our deletion routine. It may persist in encrypted backups until those backups age out, which is covered in section 8.

7. What Goes to the AI, and What Does Not

BuiltUp uses OpenAI to do the reading and listening: GPT-4o for documents and drawings, Whisper for voice notes dictated on site.

Content sent through the OpenAI API is not used to train their models. We use the API on a business footing, not the consumer products, and we do not opt in to model improvement. OpenAI processes in the United States, so this is an international transfer and it is covered under the terms in section 9.

One thing worth saying plainly, because it is a commercial risk rather than a security one: AI output is a draft. Take-offs, scopes and priced items produced by the model must be checked by a human before they go to a client. Our Terms of Service say the same thing in more formal language.

8. Backups and Retention

• Database. Backed up daily and retained on a rolling window, encrypted, held by our database provider.
• Files. Object storage is versioned and durable by design at the provider level.
• Restores. A restore is a full-platform operation, not a per-customer one. If you need a single project or file back, ask support and we will do what we can from the available versions.
• Account closure. When you close your account we delete your workspace data within 30 days, apart from records we are required to keep for tax and accounting purposes, such as invoices.

Retention detail for personal data sits in the Privacy Policy. The processing terms sit in the Data Processing Addendum.

9. Sub-processors and Where Data Goes

We do not run our own data centre. BuiltUp is built on a named set of providers, and each one is listed on the sub-processors page with what it does and where it processes.

Several of those providers are based in the United States, so customer data does leave the UK. We do not claim UK-only data residency, because it would not be true. International transfers are covered by the UK International Data Transfer Addendum (IDTA) or the EU Standard Contractual Clauses, depending on the provider, together with the additional measures set out in those agreements.

We give account owners at least 30 days' notice by email before a new sub-processor starts handling customer data, so you have time to raise an objection.

10. Reporting a Vulnerability

If you have found a fault that could put customer data at risk, tell us before you tell anyone else. Email security@builtup.io with enough detail to reproduce it: the URL or endpoint, the steps, and what you were able to reach.

Safe harbour

If you research in good faith and stick to the rules below, we will not pursue legal action against you and we will not report you:

• Use your own test account. Do not access, modify or download another customer's data. If you touch it by accident, stop and tell us.
• No denial of service, no load testing, no spam, no social engineering of our staff or our customers.
• Give us a reasonable window to fix it before you publish.

We do not currently run a paid bug bounty. We are a small team and we would rather be straight about that than advertise a reward we cannot fund.

11. Certification Status

Most security pages are a list of badges. This one is a status list, because the difference between a certificate we hold and a certificate we intend to hold is the whole point of asking. Nothing below is certified today.

Until those complete, the controls described on this page are commitments we make and practices we follow. They have not been examined by an external auditor. If your procurement process requires a certificate or a test report today, we do not have one, and the right answer is for us to tell you that at the start rather than three weeks into a questionnaire.

If a certification is a condition of the work you want to do with us, write to security@builtup.io and tell us which one and by when. Real demand from customers is what moves these up the list, and this page is updated the day any of them changes state.

12. Contact