Security
Last updated: June 10, 2026
1. Encryption
All traffic between your devices and Buildero is encrypted in transit with TLS 1.2 or higher — connections using older protocols are rejected. Data at rest, including the database and uploaded files, is encrypted with AES-256. Payment card details never touch our servers: they are sent directly to Stripe over Stripe's own encrypted connection, and we store only a tokenized reference.
2. Infrastructure
Buildero runs on Vercel (application hosting and delivery) and Supabase (PostgreSQL database, authentication, and file storage). Both providers maintain SOC 2 Type II compliance, and all production data is hosted in United States regions. We do not operate our own physical servers — operating system patching, network security, and physical access controls are handled by these providers under their compliance programs.
3. Multi-Tenant Isolation
Buildero is a multi-tenant system, and isolation between companies is enforced at the database level — not only in application code. Every database query runs through PostgreSQL row-level security (RLS), with the requesting company's identity set on the connection before the query executes. Even if application code contained a bug, the database itself refuses to return or modify rows that belong to another company.
4. Authentication
Sign-in is handled by Supabase Auth. Passwords are stored as salted bcrypt hashes and are never stored or logged in plain text. Sessions use secure, HTTP-only cookies, and all state-changing requests are protected against cross-site request forgery (CSRF). On the mobile apps you can enable biometric unlock (Face ID, Touch ID, or fingerprint); credentials are kept in the device's secure storage, never in plain text. Inside your account, role-based access control (Owner, Admin, Foreman, Worker) limits what each crew member can see and do.
5. Subprocessors
We rely on the following subprocessors to operate the Service. Each receives only the data required for its function: • Supabase — database, authentication, file storage • Vercel — application hosting and delivery • Stripe — payment processing • Anthropic — AI features (Claude models) • Resend — transactional email • PostHog — product analytics • Sentry — error monitoring • Cloudflare — bot protection (Turnstile) • Upstash — rate limiting • Twilio — SMS messaging We do not sell your data, and no subprocessor is permitted to use it for advertising.
6. Responsible Disclosure
If you believe you have found a security vulnerability in Buildero, email security@buildero.ai with a description and steps to reproduce. We aim to acknowledge reports within 72 hours, and we will not pursue legal action against good-faith security research. Machine-readable contact details are published at /.well-known/security.txt per RFC 9116. Please test only against your own account and never access data that belongs to other customers.
7. Data Retention & Deletion
Your data stays in your account for as long as you keep the account. When you delete records — or your entire account — the live data is removed, and encrypted backups containing it age out automatically on a rolling schedule rather than being kept indefinitely. To request full deletion of your company's data, email support@buildero.ai; we complete deletion requests within 30 days.