Data and security

Your data stays in your workspace

Every record in bildflow belongs to one workspace, and the database itself refuses to return another workspace's rows — not just the app's screens. Within your workspace, access depends on the person:

• Staff see the workspace's projects, leads, buyers and settings according to their role.
• Buyers see only their own units, the documents shared with them, their payments and their conversation.
• Agents see your inventory and the files and fields you share with agents — never buyers or leads.

Files

• Documents, message attachments and PDFs in construction updates are stored privately. Every download uses a signed link that is only issued to someone allowed to see that file. In the staff app and the buyer portal the link expires after about a minute; in the agent portal it lasts an hour, so an agent's browsing session is not cut short.
• Images meant to be shown — covers, galleries, unit images — are served publicly so the portals and your website can display them. Do not upload anything confidential as a gallery image; add it as a document with the right visibility instead.
• Agent-portal downloads are watermarked "Confidential" with your company name and who they were prepared for.

Activity log

bildflow records changes to projects, units, buyers, leads, payments, design selections, documents, milestones, construction updates, messages and bookings automatically. Open Activity in the sidebar to see who changed what and when, filtered by type. Project and buyer pages show their own recent activity.

• Each entry shows the person who made the change, or System for automatic changes.
• Entries are kept for 12 months.
• When a person's data is erased, their name and contact details are removed from the log too.

Accounts and sessions

• Passwords are at least 8 characters. Sign-in cookies cannot be read by scripts on the page.
• The agent-portal passphrase is stored only as a one-way hash, and changing it signs everyone out of the shared link.
• Google Calendar connections are stored encrypted, and bookings never send invitations to visitors.

Hosting and processors

bildflow is hosted in the EU. The services that process data for us — database and file hosting, payments, email, AI providers and, when configured, maps — are listed in the Privacy Policy. Our Data Processing Agreement sets out how we handle your workspace's data on your behalf.