Security

CostLogic runs on Supabase (PostgreSQL database, object storage, and authentication) hosted on AWS infrastructure, with the application served from Vercel. All traffic is served over HTTPS with HTTP Strict Transport Security, and the app ships a set of hardening headers including a strict frame policy and MIME-sniffing protection.

• Data in transit is encrypted via TLS.
• Stored files and database records are encrypted at rest by our cloud provider.
• Uploaded plans live in a private storage bucket with no public read access. They are reachable only through short-lived signed links or an authenticated proxy that re-checks which company you belong to on every request.
• Row-level security policies scope every database read and write to the company that owns the record, so one workspace cannot reach another's data even if application code were wrong.
• Sessions are managed via secure, HTTP-only cookies.

You can sign in with a one-time code sent to your email, with a password you set, or with Sign in with Google.

• Signing in with a password from a browser we have not seen before also requires an emailed one-time code, so a stolen password on its own cannot open a session. That verification lasts about six months per browser, then is asked for again.
• Sign-in codes are six digits, single-use, expire in 10 minutes, and only the newest one works.
• Sign-in and code requests are rate-limited, and sign-up and sign-in are protected by bot detection.
• We deliberately email codes rather than sign-in links: corporate mail scanners pre-fetch links and would burn a single-use token before you ever opened the message.

Your projects, customers, estimates, and invoices belong to your company workspace, and only members of that workspace can reach them. The owner and administrators control who is invited, what role each member holds, and who is removed.

Documents reach your customers only when you send them. A sent estimate or invoice is served from an unguessable link that you can revoke at any time, and those links carry a human-verification challenge so automated scanners cannot pull a document by guessing at addresses. Shared pages and file downloads are marked so search engines never index them.

CostLogic's AI features run only when you invoke them, and transmit only the content the feature needs. They are served by third-party providers on infrastructure in the United States.

Onyx, AI page naming, and AI scale detection (Fireworks AI)

These features run on DeepSeek V4 Flash, an open-weight large language model. Open-weight means the model's parameters are published for anyone to download and run on their own hardware. The weights were published by DeepSeek, an AI lab based in China; the model itself is hosted and operated for us by Fireworks AI, Inc., a United States company, on US-based infrastructure. Your data is sent only to Fireworks AI. It is not sent to DeepSeek, and DeepSeek has no access to it.

What each feature sends: AI page naming and AI scale detection send the text extracted from a plan page. Onyx sends the chat messages you write plus the project, takeoff, estimate, and invoice data relevant to your request, read through your own account permissions. If you ask Onyx about your notes pad, the text in that pad is sent too - its "Read your notes pad" tool can be switched off in Settings → Onyx AI, and the pad is never read unless you ask. Once read, that text is kept with the rest of that conversation and is sent again with each later message in the same chat; clearing the chat deletes it.

What Fireworks AI does with it: answer the request, nothing more. Fireworks AI operates under a zero-data-retention policy for the inference requests we make: your content is processed in memory to generate the response and is not stored on its systems afterward, and its terms of service commit that customer content is not used to train or improve its models. (Its terms carry narrow exceptions, such as automated safety screening and retention required by law.) Your Onyx conversations live in your CostLogic account, not with the AI provider, and clearing a chat deletes it.

Auto Room (Tectly)

When you run Auto Room, the image of the plan page you are working on is sent to Tectly, which detects rooms and areas and returns them so we can build takeoff layers.

Each provider processes the content it receives under its own terms and privacy policy, which govern how it retains or uses that content. If you would rather not have particular content processed by a third-party AI provider, do not run the AI features on that content.

We use product analytics, provided by Mixpanel, to see how the Service is used at the account level - which pages are visited and which actions are taken, never the contents of a plan, estimate, invoice, or customer record. Session replay runs on the marketing, sign-up, onboarding, and dashboard pages with every input masked; inside the application all on-screen text is masked as well and images are excluded. It never runs in the takeoff workspace or on the document links your customers open. Alongside that we use aggregate, cookieless traffic and page-performance measurement from our hosting provider, bot-detection tooling on sign-up and sign-in, and a human-verification challenge on shared document links; these inspect request signals such as IP address and browser characteristics. We do not sell data. No advertising tag is ever loaded inside the application, so your projects, plans, estimates, invoices, and customer records are never exposed to an advertising platform. Our public marketing pages do carry advertising measurement; the Privacy Policy sets out exactly what it sees, and names the providers we use for all of this today.

Sign-in codes are sent to your email, so keep your email account secure and never share a code with anyone. If you set a password, use one you do not reuse elsewhere. You are responsible for who you invite to your workspace, what role you give them, and the documents and links you choose to send.

If you discover a security vulnerability or suspect unauthorized access to your account, contact us immediately:

CostLogic does not currently hold SOC 2, ISO 27001, or similar third-party certifications, and has not undergone an independent penetration test. We do not offer SAML single sign-on, an authenticator-app or hardware-key second factor, audit-log export, or a contractual uptime commitment at this time. New-device email verification is a step-up check, not a substitute for a full second factor. This page describes our current practices and may be updated as they evolve; it is not a warranty.