Where your data lives
You're trusting us with your whole company's books. Here's exactly how that trust is engineered — in plain language, and limited to what we can actually demonstrate.
The architecture is the security
Most construction platforms put every customer into one giant shared database, separated by software rules. SelfConstruct provisions a complete, separate system per company — its own application service, its own database file, its own storage volume, and its own session-signing secret. There is no customer-id column to get wrong, because no other company's data exists inside your instance. A problem in one instance is contained to that instance.
🔒 Backups sealed so even our servers can't read them
Offsite backups are encrypted with public-key cryptography (X25519 + AES-256-GCM). Your instance can create a sealed backup but can never open one — the key that decrypts lives offline with the operator, never on any server. A stolen backup file is noise. Each backup bundle contains your database and your uploaded files, and our restore tool checks a restored copy for database integrity, confirms your records are present, and confirms the ledger's debits still equal its credits.
📱 Two-factor authentication
Office logins support authenticator-app codes on top of the password — for the company admin credential and for individual team logins. One phished password is no longer enough to open your books.
🔑 Who at SelfConstruct can get in
We don't sign in to your instance unless you open a support window for us. You open it from Settings with a reason and a time limit, it expires by itself, you can revoke it at any time, and every sign-in we make through it is written into your own activity feed.
Until you replace the starting password you were given, we know it — replace it under Settings → Users & Security when you first sign in. And like any host, our infrastructure administrators could technically reach the server your instance runs on: your live database sits on a hosting volume we administer, and it is not sealed there the way your offsite backups are.
🔐 Encrypted in transit, hardened at the door
HTTPS on every connection — our .app domains are HSTS-preloaded, so browsers refuse plaintext outright. Passwords are stored as salted PBKDF2-SHA256 hashes (600,000 rounds, the current OWASP figure; older hashes are re-stored at that cost on the next sign-in). Login and portal-code guessing hits automatic lockouts. Uploaded files serve under unguessable names with signed, expiring links. Changing a password immediately ends the sessions that were using the old one, and deactivating a team member ends their access on their next request rather than whenever their session happens to expire.
👀 Portals see only what you share
Clients, crews, and subs each enter through their own scoped door, and every portal query is restricted to the specific job that door belongs to. A client sees their job's shared progress — never your costs, margins, or other clients. Internal notes and cost data never render on client-facing pages.
💳 We never store card numbers
SelfConstruct does not process card payments and never receives cardholder data. Payment methods appear in your settings only as labels you type, like "Visa •4421".
🏦 We never hold your banking credentials
Bank transactions come into SelfConstruct the old-fashioned safe way: you download an OFX/QFX or CSV statement from your bank and upload it. There is no bank login, no stored password, and no third-party aggregator connection — so there is no banking credential of yours for anyone to steal from us.
🚪 Leave with everything
Your data is a company asset, not a hostage. You can take a full company export yourself at any time — Settings → Your data → Full company export builds a zip holding a byte-for-byte copy of your database, every uploaded file, every table as CSV, and a manifest with a checksum for each one. When you cancel we also provide that copy directly, then delete your instance and its storage. Encrypted offsite copies then age out of retention on their normal schedule rather than disappearing the same day.
How backups actually work
Being specific here matters more than sounding impressive:
- Local snapshots are taken about every six hours and kept on a rolling basis on your instance's volume. These are for fast recovery from a mistake, not from losing the volume.
- Offsite copies are sealed and shipped to storage separate from the hosting volume, on three clocks: your database every hour, your uploaded files every day, and a complete sealed bundle of both weekly. The hourly copy is the one that matters, because a day of bookkeeping is the part that cannot be reconstructed from anywhere else.
- What that means for you: losing the hosting volume outright costs you at most about an hour of bookkeeping and about a day of uploaded documents. Those are targets we hold ourselves to, and an automated check reads the shipping schedule and fails the release if it drifts past them — so the number on this page and the number in the code cannot quietly diverge.
Honest limits
No vendor should tell you they're unhackable — anyone who does is selling something else. Some specifics we'd rather you hear from us than discover later:
- We are a young company, and SelfConstruct has not yet had an independent third-party penetration test or a SOC 2 audit. We don't claim certifications we don't hold. An independent security review is on the pre-launch plan.
- Our security work is documented and self-assessed today. We run automated tests over authentication, permissions, and accounting integrity on every release, and we block a release when they fail — but self-testing is not the same as an outside audit, and we won't pretend it is.
- If we ever confirm unauthorized access to your data, our commitment is to notify you promptly — our target is within 72 hours — with what happened, what was involved, and what we did about it, and to meet whatever the applicable law requires of us.
What we can tell you: the architecture contains failures instead of amplifying them, the backups are useless to a thief, and there's a written plan for the bad day. Questions we haven't answered here: hello@selfconstruct.app — you'll get an engineer's answer, not a brochure's.