Built for enterprise security standards
Per-firm data isolation
Every project, template, and evidence item is scoped to an owning firm and enforced in the query itself -- not left to a middleware check a future route could forget to apply. A cross-firm access attempt is denied at the route layer.
Authentication and access control
TOTP-based two-factor authentication with recovery codes, session-based auth, and role-based access at both the firm and team level. A role like Environmental Professional is a compliance credential, not an org position -- it's assigned deliberately, not inferred.
Append-only audit log
Every sign-in, role change, invite, declaration signature, and approval is recorded. The log is written to, never edited -- it's the same record a challenged report would be reconstructed from.
Upload verification
Uploaded files are checked by their actual content (magic bytes), not the file extension or MIME type the browser claims -- a client can't declare its way past this check.
Where your data actually goes
Your data trains nothing
Nothing you upload is used to train a model -- not ours, not our model provider's. Your files are read to analyze your project, and for nothing else.
Only your team sees it
Your licensed and confidential data stays inside its own project. Only your team members can see it.
Always encrypted
Data is encrypted in transit (TLS) and at rest at the database layer.
Running a vendor security review?
Request a Data Processing Agreement, ask about certification timelines, or bring a security questionnaire directly to a call.
Talk to us