Security

Every table that holds your data enforces Row Level Security at the database level — access is checked by the database itself on every query, not just by application code. We run an automated test that creates two separate companies and verifies neither can read, write, or delete the other's data across every table, and we run it again whenever the schema changes.

Sign-in is handled by Supabase Auth (email/password and Google). Server-side credentials — including the key that can bypass tenant isolation for administrative tasks — are stored only in server environment variables, never in the database and never shipped to your browser.

Your subscription is billed through Stripe Checkout — we never see or store your card details. Separately: PreConstruct AI does not process payments between you and your clients. We never collect bank account numbers, routing numbers, or any payment credential for that purpose — your payment instructions to clients are plain text you write yourself.

We rely on Supabase (database, authentication, file storage), Stripe (billing), Vercel (hosting), Resend (transactional email), and third-party AI providers for document analysis. Uploaded documents are not used to train third-party models.