Security at EquipTalkIQ

Tenant isolation

Each contractor company is its own tenant. Every business table carries the company a row belongs to, and Postgres row-level security checks that the signed-in person is a member of that company before any row is read, created, changed or deleted. The check runs in the database, so a bug in a page or an API call cannot read across tenants.

• Same-company guard. A database trigger rejects any row that points at another company’s site, project, turnover package, room or share, and the company of a row can never be changed after it is created.
• Private file storage. Drawings, specifications, room documents, submittals and visit photos sit in private storage buckets whose access rules follow the same membership or grant checks as the records they belong to.
• Demo sandboxes. People exploring the demo share one sample company, but each sees only the rows they created, plus the read-only sample data.

Owners, GCs and reps

Invited building owners, general contractors and manufacturer reps are never members of the contractor’s company. They read only the building, project, turnover package or room they were granted, through views built for them that leave out pricing, labor rates, internal notes and other parties. An invitation takes effect only after the invited person confirms their email address.

A turnover package can also be shared by link. The link carries a random token that is stored only as a hash, expires on the date set when it was created, and can be revoked at any time.

How the AI handles your data

• The caller’s permissions, not a master key. The company assistant runs under the signed-in person’s own token, so row-level security decides what it can read and where the conversation is stored. Conversations belong to the person who started them.
• One assistant per audience. The company chat with its record tools is available to contractor staff only. Owners, GCs and reps get a separate assistant that answers from their own view of the data, has no tools into the contractor’s workspace, and names only records that are checked against that view before they are shown.
• Inbound text is data. Email bodies, documents and tool output are passed to the model as data, never as instructions. AI answers render images only from this site and ask before opening outside links.
• AI proposes, people approve. Takeoff marks, dispatch proposals, plans, warranty claims and RFIs are drafts until a person accepts them. Nothing in the product writes a setpoint or commands a controller.
• Model provider. Prompts and answers are processed by Anthropic through its commercial API to return the answer. See the privacy notice for how that processing is described.

Metering and budgets

Every model call writes one usage record: the person and their account type, the product feature, the model, tokens, the cost at list price, the outcome, and the site, project, thread and records it touched. Company admins see and export the breakdown on the AI usage page. Each company can set a monthly budget with a warning near the limit and a hard stop that refuses calls before any tokens are spent. Questions from invited owners, GCs and reps are recorded against the company whose data they asked about.

Sign-in and application security

• Sign-in. Email and password, an emailed one-time link, or Google sign-in, handled by our authentication provider. Passwords are never visible to us.
• Every server call is verified. Server functions and the AI endpoints check the signed session token on each request, and cross-site calls to server functions are refused. The only calls without a session are the shared turnover link, which checks its hashed token first, and the background jobs below.
• Background jobs. Scheduled jobs require a server secret, and document-processing workers accept only a single-use token issued for that run.
• Encryption in transit. The site, the API and every provider connection use HTTPS.
• Secrets. The database service-role key, the model provider key and the server-side maps key live only in the hosting provider’s server environment and never ship to the browser.

Hosting and sub-processors

EquipTalkIQ is built and operated by Axiom Routing on these providers:

• Vercel: application hosting and delivery over HTTPS.
• Supabase: Postgres database, authentication and file storage, encrypted at rest by the provider.
• Anthropic: the AI models behind every assistant and draft.
• Mapbox: map tiles and drive-time estimates, only on the map, Command Center and dispatch pages.
• Google: sign-in for people who choose “Continue with Google”, and the web fonts on this site.

Mail and file connectors for Google Workspace or Microsoft 365 are not active for customer accounts today; this list will change before they are.

Data we do not hold

EquipTalkIQ is for building, equipment, project and service records. It does not process protected health information, and it is not designed for patient data, so please do not upload it. There are no payment card or bank details in the product. The public site sets no analytics or advertising cookies.

Certifications

EquipTalkIQ does not hold a SOC 2 report or any other security certification today. If your review requires one, tell us. We will explain where we stand and answer your questionnaire in writing.

Questionnaires and reporting an issue

For a security questionnaire, a vendor review or a call with your security team, email hello@equiptalkiq.com with your deadline and format. We answer from how the product is built and say plainly when something is not in place yet.

If you believe you have found a vulnerability, write to hello@equiptalkiq.com with the steps to reproduce it. Please do not access other customers’ data or disrupt the service while testing. We will acknowledge your report and keep you informed while we fix it.