Security
Your tender documents deserve the same rigour as your figures
This page describes what actually exists — the mechanisms in place today. It promises nothing the product does not do.
Security measures in place
Per-company isolation
Every piece of data — job, document, takeoff, estimate — belongs to one company and one only. Isolation is enforced at the database level itself (PostgreSQL Row Level Security), not just in application code.
A query can only read or write the data of the signed-in account's company, whatever route it takes.
Authentication and roles
Authentication is delegated to a specialised identity provider (Clerk), with organisations and roles. Client personas (read-only) are blocked from every write action, globally.
No business page is served without an authenticated session.
Data hosted in the European Union
Application data is stored on Supabase (PostgreSQL and file storage) in a European Union region.
Your documents — drawings, specifications, bills of quantities, site photos — are served only through time-limited signed links: no public file URLs.
Secrets stay server-side
Access keys (database, AI models, e-mail) never leave the server: nothing sensitive ships in the browser bundle.
Keys are managed in the hosting environment, never in source code.
AI that never fabricates
This is a security property too: every AI output is validated against a strict schema before being stored, carries per-item confidence, and whatever could not be determined is declared as a gap — never filled in.
An automated measurement bench continuously enforces zero invented quantities on reference geometries.
Certifications: what we claim — and what we don't
Edyfyce claims no certification of its own today. Our infrastructure providers — hosting, database, authentication — maintain their own security certifications; the details are published on their respective compliance pages.
We prefer describing the mechanisms in place precisely over displaying badges. If a certification of our own is ever obtained, it will be announced here — not before.
Reporting a vulnerability
Responsible reports are welcome. A dedicated disclosure channel will be published on this page; in the meantime, customers can go through their usual Edyfyce contact. We acknowledge receipt and keep the reporter informed.