SECSecurity
Security That Is Enforced, Not Promised
BuildEase treats the browser as untrusted. Every request is checked on the server and again in the database, as the person making it.
00The controls, in numbers
- 2
- steps to sign in: a password and an authenticator app
- 7
- dimensions of authority checked on every action
- 12 h
- the longest a session can last
- 40 min
- without renewal, and the session ends
- 4
- separate service logins, each with only its own rights
- 0
- table writes made directly by the browser or the web server
01Company & project data isolation
Company & Project Data Isolation
Your company's data stays protected. Your projects remain under your control.
BuildEase is designed with a multi-tenant security architecture that separates subscribing companies' data and enforces controlled access to project information.
- Between Companies
- Each subscribing company's workspace is kept apart: another company cannot open its projects, people or records.
- Within a Project
- The company running a project registers the organisations taking part, and they work together inside that project, each within its role and permissions. Taking part in one project opens nothing else.
Your company
Project A
- Project owner
- PMC
- Consultant
- Contractor
One project, several organisations, each within its role
Project B
- Its own project team
Another subscribing company
Its projects, people and records
Company-Level Data Isolation
Each subscribing company operates within its own governed environment. Access controls are designed to prevent unauthorised access to another company's confidential information, project records and administrative data.
Project-Level Access Control
Project information is accessible only to authorised users based on their assigned project memberships, organisational responsibilities and role-based permissions.
Secure Multi-Organisation Collaboration
Project owners, consultants, PMC teams, contractors and other authorised stakeholders can collaborate within a shared project environment while maintaining defined access boundaries and responsibilities.
Role-Based Permissions & Accountability
Access to documents, approvals, workflows and administrative functions is governed by permissions appropriate to each user's responsibilities, supporting accountability and controlled information sharing.
One Connected Platform. Controlled Access. Protected Project Information.
02Access Control
Access Control
- Organisation
- Project
- Role
- Discipline
- Document type
- Workflow stage
- Action authority
All seven hold: done, and recordedAny one fails: refused, and recorded
Two-Step Sign-In
A password and an authenticator app, pinned to the person's account. A session lasts at most 12 hours and ends after 40 minutes without renewal.
Authority Checked per Dimension
Organisation, project, role, discipline, document type, workflow stage and action authority are each checked; none is flattened into another.
Every Session Re-Checked
Each transaction confirms the person, their organisation and company are active and the session is the one the application issued.
Delegation With Limits
Acting for someone has an end date, stays inside their scope and organisation, and cannot be passed on.
03Tenant Isolation
Tenant Isolation
- BrowserUntrusted
- ServerChecks the request
- DatabaseChecks the person
- One commandAuthorise, validate, write
- Audit historyRecorded and sealed
Row-Level Security, Forced
Every table enforces row-level security for company, project and person, including for the application itself.
No Direct Writes
Neither the browser nor the web server writes tables. Every change is one database command that authorises, validates, writes and records.
Separate Storage per Company
Each company's files sit in its own storage area with its own credentials; file storage accepts browser requests only from the application's own address.
Least-Privilege Services
The web application, background worker, backups and invitations each use their own database login with only the rights they need.
04Data Handling
Data Handling
Append-Only History
Every change and every refused attempt is recorded in an audit history that nobody can edit, sealed in a hash chain.
Originals Never Altered
Submitted files and records are immutable; corrections are new revisions.
Encrypted in Transit
Every connection to the application uses TLS.
Hosted in Riyadh
The application, its database and file storage run in a Riyadh, Saudi Arabia hosting region.
Security Infrastructure & Hosting
BuildEase is delivered over encrypted HTTPS connections (TLS 1.3), with SSL/TLS protection for data transmitted between users and BuildEase.
Our infrastructure is hosted in Riyadh, Saudi Arabia, in a professionally managed cloud hosting environment.
Security is supported by multiple layers of protection, including encrypted communications, controlled access and application-level security measures.
BuildEase continues to strengthen its security practices as the platform evolves.
Website Security & Privacy
The BuildEase corporate website operates separately from the construction project management application and does not serve as a repository for project documents or operational project data.
Demo enquiries are handled through the website's designated submission process, with appropriate measures to protect information in transit.
For further information about our security practices, infrastructure or data handling, please contact the BuildEase team.
Contact us