Security

CostLogic runs on Supabase (PostgreSQL database, object storage, and authentication) hosted on AWS infrastructure, with the application served from Vercel. All traffic is served over HTTPS with HTTP Strict Transport Security, and the app ships a set of hardening headers including a strict frame policy and MIME-sniffing protection.

• Data in transit is encrypted via TLS.
• Stored files and database records are encrypted at rest by our cloud provider.
• Uploaded plans live in a private storage bucket with no public read access. They are reachable only through short-lived signed links or an authenticated proxy that re-checks which company you belong to on every request.
• Row-level security policies scope every database read and write to the company that owns the record, so one workspace cannot reach another's data even if application code were wrong.
• Sessions are managed via secure, HTTP-only cookies.

You can sign in with a one-time code sent to your email, with a password you set, or with Sign in with Google.

• Signing in with a password from a browser we have not seen before also requires an emailed one-time code, so a stolen password on its own cannot open a session. That verification lasts about six months per browser, then is asked for again.
• Sign-in codes are six digits, single-use, expire in 10 minutes, and only the newest one works.
• Sign-in and code requests are rate-limited, and sign-up and sign-in are protected by bot detection.
• We deliberately email codes rather than sign-in links: corporate mail scanners pre-fetch links and would burn a single-use token before you ever opened the message.

Your projects, customers, estimates, and invoices belong to your company workspace, and only members of that workspace can reach them. The owner and administrators control who is invited, what role each member holds, and who is removed.

Documents reach your customers only when you send them. A sent estimate or invoice is served from an unguessable link that you can revoke at any time, and those links carry a human-verification challenge so automated scanners cannot pull a document by guessing at addresses. Shared pages and file downloads are marked so search engines never index them.

CostLogic's AI features run only when you invoke them, and transmit only the content the feature needs. They are served by third-party providers on infrastructure in the United States.

Onyx, AI page naming, and AI scale detection (Fireworks AI)

These features run on DeepSeek V4 Flash, an open-weight large language model. Open-weight means the model's parameters are published for anyone to download and run on their own hardware. The weights were published by DeepSeek, an AI lab based in China; the model itself is hosted and operated for us by Fireworks AI, Inc., a United States company, on US-based infrastructure. Your data is sent only to Fireworks AI. It is not sent to DeepSeek, and DeepSeek has no access to it.

What each feature sends: AI page naming and AI scale detection send the text extracted from a plan page. Onyx sends the chat messages you write plus the project, takeoff, estimate, and invoice data relevant to your request, read through your own account permissions. If you ask Onyx about your notes pad, the text in that pad is sent too - its "Read your notes pad" tool can be switched off in Settings → Onyx AI, and the pad is never read unless you ask. Once read, that text is kept with the rest of that conversation and is sent again with each later message in the same chat; clearing the chat deletes it.

Auto Room (Tectly)

When you run Auto Room, the image of the plan page you are working on is sent to Tectly, which detects rooms and areas and returns them so we can build takeoff layers.

Each provider processes the content it receives under its own terms and privacy policy, which govern how it retains or uses that content. If you would rather not have particular content processed by a third-party AI provider, do not run the AI features on that content.

We use aggregate, cookieless product and performance analytics to see which features are used and how fast pages load, plus bot-detection tooling on sign-up and sign-in and a human-verification challenge on shared document links. These inspect request signals such as IP address and browser characteristics. We do not run advertising networks, cross-site tracking, or session replay, and we do not sell data. The Privacy Policy names the providers we use for this today.

Sign-in codes are sent to your email, so keep your email account secure and never share a code with anyone. If you set a password, use one you do not reuse elsewhere. You are responsible for who you invite to your workspace, what role you give them, and the documents and links you choose to send.

If you discover a security vulnerability or suspect unauthorized access to your account, contact us immediately:

CostLogic does not currently hold SOC 2, ISO 27001, or similar third-party certifications, and has not undergone an independent penetration test. We do not offer SAML single sign-on, an authenticator-app or hardware-key second factor, audit-log export, or a contractual uptime commitment at this time. New-device email verification is a step-up check, not a substitute for a full second factor. This page describes our current practices and may be updated as they evolve; it is not a warranty.