Security
Enterprise security, by default.
This page is maintained by Construction OS to answer common security and privacy questions about the platform. It describes controls that are currently enabled — it is not a certification.
Controls
What we operate
Authentication
Email + password with optional SSO on Business and Enterprise. Session management, forced sign-out and role-based access.
Authorisation
Role-based access with owner, PM, contractor and client scopes. Every action is checked server-side.
Encryption
TLS in transit; encryption at rest for data and backups. Secrets managed by the platform.
Data handling
Tenant-isolated data model. Customers own their data and can export or delete on request.
Hosting
Runs on hardened, globally distributed infrastructure with automated backups.
Audit log
Append-only audit trail across the platform, visible in the Admin module.
Shared responsibility
Where our controls end and yours begin
Construction OS is responsible for
Platform availability, encryption, secret management, infrastructure hardening, backup and restore, and the security of features we ship.
You are responsible for
User provisioning, role assignments, strong passwords or SSO enrolment, data classification, and internal review of any content uploaded to the platform.
Contact
Reporting a security issue
If you believe you've found a security issue, please contact us at oracle@inifye.tech. We acknowledge reports within one business day.