Security & Privacy Overview

1. What BuildMapper holds

BuildMapper is a sales-intelligence platform for building-product suppliers and trade contractors. Two kinds of data live in it, and they are treated differently.

Public-record data we compile: building permits published by municipalities, with the builder, project and contact details that accompany them. This corpus is shared across all customers; it is not yours and not confidential. Person-level contact details on it are masked in the database until an account is entitled to see them.

Data you give us: your users’ names and emails; the customer lists, contact exports, price books, catalogs, plans and permit exports you upload; your pipeline, notes, quotes, invoices, chat and outreach; and, if you connect them, records mirrored from your ERP or CRM. This data belongs to you, is visible only to your team, and is never shared with another customer, sold, or used to train AI models.

2. Where it lives

Application hosting

Vercel (Pro plan)

Database, authentication, file storage

Supabase, on Amazon Web Services

Region

United States (AWS us-east-1). Disclosed in our Privacy Policy.

Encryption in transit

TLS 1.2+ on every connection, HSTS enforced

Encryption at rest

AES-256, managed by the database and storage provider

Backups

Daily, retained 7 days, provider-managed

Provider attestations

Vercel, Supabase, AWS, Anthropic, Stripe and Resend each hold SOC 2 Type II. BuildMapper does not yet hold its own report (section 7).

3. How it is protected

Isolation is enforced in the database, not the interface. Every table carries Postgres row-level security. A query from your account can only return rows your account or team owns, regardless of what the application code asks for. Server-side jobs that run with elevated privilege carry an explicit customer scope, and automated checks in our build fail if one is missing.

Sign-in. Email and password, one-time email link, or Google sign-in, through Supabase Auth. Sessions use secure, same-site cookies with short-lived tokens refreshed server-side. Two-step verification with an authenticator app is available to every account, and a team manager can require it for the whole team. Single sign-on is not yet available (section 7).

Roles. Each team has an owner, managers and members. Manager-only surfaces (territory, routing, team settings, integrations) are gated on the server. A separate platform-admin flag, held by BuildMapper staff only, gates our internal console.

Contact masking. For accounts not entitled to a record, names, addresses, phones and emails are replaced in the database query itself, so masked details never reach the browser.

Files. Uploaded customer files, price books, plans, permit exports and chat attachments are stored in private buckets and served through short-lived signed links. Files sent to us for onboarding go into a dedicated inbox bucket that only our support tooling can read; every download is logged.

Integrations. API keys are hashed at rest, scoped to specific permissions, rate-limited and only issued to paid accounts. Webhooks we send are HMAC-signed. Webhooks we receive (Stripe, our messaging partner) are signature-verified. ERP and CRM connections are read-only into BuildMapper; we never write to your ERP.

Secrets. All credentials live in the hosting provider’s encrypted environment, never in source code.

4. When our staff work inside your account

Some customers ask us to do their setup for them. When that happens, access is granted for a fixed window (7 days by default, 30 at most) with a stated reason, and you are emailed the moment it is created. You can decline or revoke it at any time from Settings → Security, and the session ends on the next request. Every page our staff open and every change they make is logged and retained. Billing, payment details and password changes are blocked during a support session, and support activity is excluded from your usage analytics.

5. Who else processes your data

We use a small number of providers under their commercial terms. None may use your data for their own purposes. Card numbers are entered directly into Stripe’s hosted fields and never pass through BuildMapper.

6. AI, specifically

Anthropic (Claude) is the only large-language-model provider. There is no OpenAI or other model in the product.

Your inputs are not used to train models. Anthropic’s commercial API terms prohibit it, and we have never opted in to any data-sharing program.

When you upload a spreadsheet (a price list, a customer file), the model sees only the column headers and a handful of sample rows to work out the layout. The actual cell values, including prices and revenue figures, are copied by deterministic code and never leave our servers.

AI answers about your catalog are governed by a fixed set of price rules: a price is quoted only when it exists in your records, and “no price on file” is the answer otherwise.

7. Where we are, honestly

Our infrastructure providers hold SOC 2 Type II. We will pursue our own report when customer demand warrants it. We would rather tell you what is not done than have you find out later.

8. Your controls

Export your pipeline, notes, contacts and activity from Settings at any time. Delete your account from Settings; deletion cascades through your records, and anything retained for legal or billing reasons is de-identified. Revoke staff access, API keys and connected integrations from Settings. Managers decide who on your team sees territory, routing and integrations, and whether the team requires two-step verification.

9. Privacy law

BuildMapper is a Canadian company operating under PIPEDA and British Columbia’s PIPA. Our Privacy Policy and Terms of Service apply. We will sign a data processing agreement on request; our standard template is in preparation. Where we become aware of a breach affecting your data we will notify you without undue delay and within any period your agreement with us specifies.

10. Reporting a security issue

Email info@buildmapper.com with “Security” in the subject. We acknowledge every report and do not pursue researchers who report in good faith. A machine-readable contact is published at /.well-known/security.txt.