Security and your plans
Your plans are your bid. Here is how we treat them.
Plain answers to what a chief estimator asks before uploading a set. Where we have a limit, it is on this page.
Private to your account
Each account sees only its own uploads, plus a small set of sample plans that belong to us. The rule is enforced on the server, not just hidden in the screen. If another customer asks for your job, the server answers "not found".
Our staff can see what is on the server
Our own staff accounts can open and delete every document on the server. That is how we support the product and look into a wrong reading.
If that is not acceptable for a set of drawings, do not upload them.
Nothing leaves the server unless you press Analyze
One optional button, Analyze, sends a picture of the sheet you are looking at to an outside AI provider, which returns a written description. It happens only when you press it, and only for that sheet. Everything else is read on our own server.
Not sold, not shared for marketing
We do not sell your data and we do not share it with anyone for marketing. Company plans get this in writing in the contract.
What is in place
The measures, without the adjectives.
Encrypted connection
Every connection to the site uses TLS.
Passwords we cannot read
Stored only as salted PBKDF2-SHA256 hashes.
One essential cookie
A signed, HttpOnly session cookie keeps you signed in. Nothing else is set.
No trackers
No analytics, no advertising and no tracking pixels. The site loads nothing from another host.
You can delete your plans
Remove from server deletes the PDF and everything derived from it. Ask and we delete the whole account.
Nightly encrypted backups
Taken every night. A restore has been tested.
Inside your company
Three roles and a record of who did what.
On Team and Company plans.
Admin
Adds people, sets roles and sees the team's activity.
Estimator
Uploads plans, runs detection, edits and approves takeoffs.
Viewer
Opens jobs and reports. The server refuses every change a viewer tries, whatever the screen shows.
The activity log records who did what on a job. It never records passwords or file paths.
The limits
What is not there yet.
CORE Takeoff runs on a shared server today. It is not a certified enterprise platform, and we would rather say so here than in a meeting.
Single sign-on planned
Not built yet. It is planned for the Company plan. Today everyone signs in with an email and a password.
Compliance certifications
We hold none today. If your company needs a specific one, tell us which, and we will tell you honestly where we stand.
A server of your own
A private server, with no other company's work on it, is included on the Company plan and is an add-on for Team. Ask us.
Retention
Uploaded drawings and their results stay on the server until they are deleted. We may also delete data as part of maintenance. Keep your own copies of your drawings.
The outside AI provider
When you press Analyze, the image of that sheet is processed on the provider's systems under their terms and retention rules, which we do not control. If you never press Analyze, no drawing leaves our server.
The full detail is in the Privacy Policy and the Terms of Service.
Need this in writing?
Company plans carry the data terms in the contract. Tell us what your company requires.