Security & data handling

A plain description of how CivilMargin protects your records. We do not claim certifications we do not hold.

Company isolation

Every record carries the company it belongs to. The server derives your company and role from your session on each request and never trusts IDs sent from the browser.

Roles and project access

Owner, Admin, Project Manager, QS/Accounts and Viewer roles. Non-admin roles see only the projects assigned to them; this is enforced in every query, not only by hiding buttons.

Accounts

Email and password sign-in through Better Auth with hashed passwords, secure HTTP-only session cookies, rate-limited sign-in and password reset.

Documents

Uploads are checked by their actual content, size and page count. Originals are processed in memory and discarded unless you opt in to file storage. Extracted text is removed once a document is confirmed.

AI providers

Off by default. When an administrator enables OpenAI or Anthropic, document text or images are sent to that provider for extraction only. Results are labelled as suggestions and require human confirmation.

Audit trail

Approvals, edits to BOQ and bills, imports, exports, extraction confirmations and integration changes are logged with who, when and what changed.

Exports

Generated on the server for your permitted projects. Spreadsheet formula injection is neutralised.

Secrets

Database URIs and API keys live only in server environment variables and are never sent to the browser or written to logs.