How your data is handled

What we collect and why

Only the project financial exports you choose to send (change orders, schedules of values, payment applications, receivables, retainage) and the names and emails of the people you invite. They are used only to reconcile your revenue and prepare drafts for you.

Where it is stored

In a dedicated database separated per organization by row-level security, and in object storage where each organization’s files are encrypted with that organization’s own key. Original files are kept unchanged so every number can be traced back.

Who can see it

People you invite, with the role you give them. Main staff see a customer’s data only by opening a logged access session with a stated reason; your organization owner can see every access in the activity log.

Protections

• Invite-only accounts with mandatory two-factor authentication
• Encryption in transit (TLS) and at rest
• Tenant isolation enforced in the application and again in the database, tested on every release
• Short-lived signed download links
• An append-only activity log of logins, exports, approvals, role changes and deletions
• Customer data is not used to train AI models. Where an AI model is used (column-mapping suggestions, plain-English summaries, drafting), it receives only what that task needs and never computes an amount

Retention and deletion

Raw uploaded files are scheduled for deletion after the engagement; full retention details are being finalized. You can export all your data or delete your organization’s data at any time; deletion ends with a deletion certificate.

NDA and incidents

A mutual NDA is available before you send anything. Report a security concern through the contact page; it reaches a person at Main.