Security
Your jobsite data, handled like it matters.
We're a small team. Security is non-negotiable. This page lists exactly how we handle the things you'd ask about in a vendor security questionnaire, and where we are on the formal certifications.
Strict access controls per organization
Every read and every write is checked against the requesting user's organization in our application code. The only way into another company's account is a time-limited, logged support session that our staff open when you ask for help.
Encrypted at rest and in transit
All your data is encrypted while it sits in storage and encrypted while it moves between your device and our servers. Industry-standard transport security on every connection.
Sign-in and session integrity
Sign in with email and password, a one-time email code, or Google. Sessions roll over automatically on a short cycle. Login cookies are locked down so they can't be lifted or replayed.
Audit trail
Every voice command, schedule change, and major action is recorded in an activity history. For a full copy of your company's data, email support@buildficient.com.
Incident response
If we detect a security issue, we'll notify affected customers within 72 hours per GDPR norms. Email security@buildficient.com to report something.
Certifications status
- SOC 2 Type II: Planned. We will update this page when an audit is underway.
- GDPR / CCPA: Our Data Processing Addendum is public. You can export key records and delete your account or company from the app. Our Privacy Policy explains what is deleted and when.
- Sub-processors: The full named list is below. The same list is in our Privacy Policy and DPA.
- Where data lives: Our database and app hosting are in the United States (AWS us-east-1). Some AI and messaging providers may process data in other regions, as listed below.
Subprocessors
Last updated: October 26, 2026
- Supabase: database, sign-in and file storage. Data: all account and project data, uploaded photos and files, sign-in details. Where: United States (AWS us-east-1).
- Vercel: hosting the web app and website. Data: all data passing through the app, IP addresses, request logs. Where: United States, with a global content network.
- Anthropic: Buildficient Assistant, photo and document reading, suggestions. Data: what you type or say to the Assistant, shared photos and documents, related project details. Where: United States.
- OpenAI: backup AI model, and receipt and bill reading. Data: Assistant messages and project details when used as a backup, receipt and bill images. Where: United States.
- Google (Gemini): backup AI model, and receipt and bill reading. Data: Assistant messages and project details when used as a backup, receipt and bill images. Where: United States and other regions.
- OpenRouter: backup AI model routing. Data: Assistant messages and project details when used as a backup. Where: United States; OpenRouter passes requests to the host of the chosen model, which may be in other countries.
- NVIDIA: backup AI model hosting. Data: Assistant messages and project details when used as a backup. Where: United States.
- Deepgram: speech-to-text and the Assistant's spoken replies. Data: voice audio while you speak, and the text of spoken replies. Where: United States.
- Resend: sending email. Data: email addresses, names, and the content of emails we send. Where: United States.
- Sent.dm: sending text and WhatsApp messages. Data: phone numbers, names, message content, delivery and opt-out status. Where: United States.
- Twilio: sending and receiving text messages. Data: phone numbers, message content, delivery and opt-out status. Where: United States.
- Zernio: sending text and WhatsApp messages. Data: phone numbers, names, message content, delivery and opt-out status. Where: United States.
- Meta (WhatsApp): delivering WhatsApp messages. Data: phone numbers and message content. Where: United States and other regions.
- Expo: sending push notifications to the mobile app, and delivering mobile app updates. Data: device push tokens and notification text; device and app version details and IP address when the app checks for updates. Where: United States.
- Apple and Google push services (and your browser's push service): delivering push notifications to phones and browsers. Data: device or browser push identifiers and notification text. Where: United States and other regions.
- Stripe: subscription billing and payments. Data: billing contact details, payment card details (held by Stripe, not us), payment history. Where: United States.
- Sentry: error and crash reports from the web and mobile apps. Data: user ID, IP address, device and browser details, the screen or request that failed. Where: United States.
- PostHog: product analytics, after you allow analytics. Data: user ID, pages and features used, device and browser details, IP address. Where: United States.
- Inngest: running scheduled and background jobs. Data: job details, which can include record IDs, names, email addresses and message content. Where: United States.
- Google Workspace: our own business email. Data: what you send us by email, such as support requests. Where: United States and other regions.
Stop typing in trucks. Start talking to your jobsite.
14-day free trial. No card required.