Support / Account, team & billing
Security, Privacy, and Your Data
Schedules hold commercially sensitive information: bid logic, delay positions, and claim support. Here's how we protect it.
Isolation between companies
Every company's data is kept separate in two layers. The application checks your organization on every request, and the database enforces the same separation with row-level security, so one company's session can't read another's data even if an application check were missed.
Accounts and sessions
- All traffic is over HTTPS. Session cookies are secure and HTTP-only, with protection against cross-site request forgery.
- Sign-in is rate-limited and locks briefly after repeated failures.
- Changing your password signs out every other session and device.
- API tokens and share-link tokens are stored hashed. API tokens can be revoked instantly, and share links expire on their own after 90 days.
Payments
Payments are processed by Stripe. We never see or store card numbers.
Backups
The database is backed up regularly, and we practice restoring from backup on a schedule rather than assuming it works.
Getting your data out
You can export any schedule at any time, including when your company is read-only: Excel, Primavera P6 XER or PMXML, Microsoft Project XML, CSV, and PDF. See Export your schedule.
Deleting your data
There's no self-serve delete. Email [email protected] from an Owner's address and we'll remove your organization.