BuildEase
العربيةRequest a demo

SECSecurity

Security that is enforced, not promised

BuildEase treats the browser as untrusted. Every request is checked on the server and again in the database, as the person making it.

00The controls, in numbers

2
steps to sign in: a password and an authenticator app
7
dimensions of authority checked on every action
12 h
the longest a session can last
40 min
without renewal, and the session ends
4
separate service logins, each with only its own rights
0
table writes made directly by the browser or the web server

01Access control

Access control

One action, seven checks
  1. Organisation
  2. Project
  3. Role
  4. Discipline
  5. Document type
  6. Workflow stage
  7. Action authority

All seven hold: done, and recordedAny one fails: refused, and recorded

Illustration, not a screenshot

Two-step sign-in

A password and an authenticator app, pinned to the person's account. A session lasts at most 12 hours and ends after 40 minutes without renewal.

Authority checked per dimension

Organisation, project, role, discipline, document type, workflow stage and action authority are each checked; none is flattened into another.

Every session re-checked

Each transaction confirms the person, their organisation and company are active and the session is the one the application issued.

Delegation with limits

Acting for someone has an end date, stays inside their scope and organisation, and cannot be passed on.

02Tenant isolation

Tenant isolation

The path of every change
  1. BrowserUntrusted
  2. ServerChecks the request
  3. DatabaseChecks the person
  4. One commandAuthorise, validate, write
  5. Audit historyRecorded and sealed

Illustration, not a screenshot

Row-level security, forced

Every table enforces row-level security for company, project and person, including for the application itself.

No direct writes

Neither the browser nor the web server writes tables. Every change is one database command that authorises, validates, writes and records.

Separate storage per company

Each company's files sit in its own storage area with its own credentials; file storage accepts browser requests only from the application's own address.

Least-privilege services

The web application, background worker, backups and invitations each use their own database login with only the rights they need.

03Data handling

Data handling

Append-only history

Every change and every refused attempt is recorded in an audit history that nobody can edit, sealed in a hash chain.

Originals never altered

Submitted files and records are immutable; corrections are new revisions.

Encrypted in transit

Every connection to the application uses TLS.

Hosted in Riyadh

The application, its database and file storage run in a Riyadh, Saudi Arabia hosting region.

What we do not claim

BuildEase does not hold security certifications today, and this page makes no compliance claim. Customers evaluating BuildEase can ask for the current security documentation through a demo request.

Request a demo

This website

The website is separate from the application and holds no project data. It sets no cookies and runs no analytics. A demo request is sent to our team over an authenticated server connection; nothing you type is stored in your browser.

Security — BuildEase