Security
How we protect your construction project data
Security at the Core
SpecAlign is built with security at its core: encryption in transit and at rest, complete tenant isolation, and an audit trail on every change. Trust is a feature, not a promise.
Infrastructure Security
Secure Cloud Hosting
All data is hosted on hardened cloud infrastructure with continuous monitoring, providing reliability and security.
Reliable Infrastructure
Continuous monitoring and automated recovery keep the platform available when your crews need it.
Offsite Disaster Recovery
Encrypted backups are stored offsite with retention locks, protecting your data even in a disaster scenario.
Regular Backups
Automated daily backups ensure your project record survives hardware failure.
Data Encryption
Encryption in Transit
All data transmitted between your browser and our servers is protected with TLS 1.3 encryption, the latest security standard.
Encryption at Rest
All stored data, including documents and database records, is encrypted with AES-256 encryption.
Secure Document Storage
Uploaded documents are stored with server-side encryption and access controlled through authenticated, permission-checked endpoints.
Password Security
Passwords are hashed using bcrypt with appropriate cost factors. We never store plaintext passwords.
Access Control
Role-Based Access Control (RBAC)
Granular permissions system allows you to control exactly who can access, edit, or manage different aspects of your projects.
Multi-Factor Authentication (MFA)
Optional two-factor authentication adds an extra layer of security to your account using authenticator apps.
Multi-Tenant Isolation
Each organization's data is completely isolated. Users can only access data within their own organization and assigned projects.
Session Management
JWT-based authentication with configurable session expiration. Sessions are invalidated on password change or logout.
Audit & Compliance
Comprehensive Audit Logs
All changes to specifications, rooms, and project data are logged with timestamps, user attribution, and before/after values.
Version History
Complete version control for specifications enables you to track changes over time and understand what was installed when.
Change Control Workflows
Optional approval workflows ensure specification changes are reviewed before being applied to your project.
Data Export
Export your project data and audit logs for compliance purposes or backup to your own systems.
AI Processing Security
When you upload documents for AI-powered extraction, your data is handled securely:
- ✓Documents are transmitted to AI providers over encrypted connections
- ✓Your original documents are never shared with other customers or used to train third-party AI models. Anonymized, aggregated specification data may improve SpecAlign's own models, as described in our Privacy Policy
- ✓We use enterprise AI APIs under data-protection terms that restrict providers from retaining your documents or using them for their own training
- ✓Every AI extraction carries a confidence score and a link to its source page, and nothing enters your project record without your review
Our Security Practices
Secure Development
Our development follows security best practices including code reviews, dependency scanning, and secure coding guidelines.
Regular Updates
We regularly update our dependencies and infrastructure to address security vulnerabilities promptly.
Monitoring & Alerting
Continuous automated monitoring for suspicious activity with alerts for potential security incidents.
Incident Response
Documented incident response procedures ensure we can quickly address any security issues that arise.
Security Questions?
If you have questions about our security practices or need to report a security issue, please contact us.
security@specalign.ai