Trust
Enterprise trust, engineered in from day one
This page is maintained by Construction OS to answer common security and privacy questions. It summarizes controls we operate; it is not a certification.
Pillars
What we operate
Access & authentication
SSO with Okta, Azure AD, Google Workspace. SCIM provisioning. MFA required. Role-based access.
Data protection
Encryption in transit (TLS 1.2+) and at rest (AES-256). Tenant isolation. Backups and disaster recovery tested quarterly.
Hosting & residency
US, EU, MENA, LATAM and APAC regions. Sovereign hosting for government workloads.
Audit & compliance
Immutable audit log, retention policies, and evidence exports for regulatory reviews.
Subprocessors
A short, published list of subprocessors with data flows and purposes. Change notifications 30 days in advance.
Privacy & rights
GDPR and equivalent regime support. Data subject requests via oracle@inifye.tech.
Shared responsibility
Where Construction OS ends and your team begins
Construction OS operates
- Platform infrastructure, hosting, patching, backups
- Encryption at rest and in transit
- Vulnerability management and penetration testing
- Product-level access controls, audit log, MFA enforcement
- Incident response and status page
Your team operates
- User provisioning, role assignment, SSO configuration
- Data classification and retention decisions
- Third-party integrations you enable
- Physical device security and endpoint controls
- Regulatory obligations specific to your organization