How we keep each company's work private
Our data processing addendum and privacy notice cover the legal terms.
Data is encrypted while it travels and while it's stored, using the same standard banks use (TLS and AES-256), through our hosting providers.
Each company stays separate
Every project record belongs to one company. When the database is connected, the rules let only that company's people read and change their own work. The browser never holds a key that can open another company.
Contract amounts, pay applications, and change-order dollars are visible to owners and project managers. Field crews and customers are blocked by those rules, not only hidden on the screen.
A customer link shows progress on one project and leaves out contract amounts. We store a fingerprint of the link, not the link itself.
Sign-in
Pages that touch billing check a signed cookie that page scripts cannot read. It lasts 8 hours, and the request has to come from Girderline. Someone who is signed out is turned away. Field crews cannot open billing.
The staff console asks for a second factor, an authenticator app or a passkey, and keeps a log of admin actions that cannot be edited afterward.
Payments
Online payments are not switched on yet. When they are, card and bank details are handled by Stripe and never touch Girderline's servers.
United Kingdom
For companies working in the United Kingdom, Girderline handles project data for the construction company that signs up, under our data processing addendum.
We do not sell personal information. Each person sees only what their role allows, sign-in expires, and you can ask us to delete your company data.
This is how the product is built. It is not a certification, a legal opinion, or a finished UK privacy audit. Read the addendum and the privacy notice, and have a lawyer look before an enterprise contract.
United Arab Emirates
For contractors in the UAE, the product is built around a clear purpose, limited access, and the company's control of its project records.
Owners decide who is invited, which customer links stay active, and when records should be removed. The details are in the data processing addendum.
This is how the product is built. It is not a certification or a finished UAE privacy assessment. Have a lawyer review it before a tender or an enterprise contract.
Where the data lives
Today the service runs in one cloud region through our hosting providers. Choosing a region in the EU, the UK, or the UAE is not available yet.
We have not published an uptime promise or service credits.
Reporting a problem
Found a security problem? Email sales@girderline.com. Please give us a reasonable time to fix it before you tell anyone else.
Girderline LLC · sales@girderline.com