BuilderPad is built for builders who can't compromise on how project, financial, and homeowner data is handled. Here's how we protect it - end to end.
TLS 1.2+ / AES-256
Encryption
In transit and at rest
No training
AI on your data
Written guarantee in our DPA
72 hrs
Breach notice
Written commitment
Never sold
Third-party data
Tenant-isolated by design
BuilderPad runs on AWS in the United States. BuilderPad Finance runs on Porter, with file storage on Microsoft Azure. Our marketing site runs on Vercel. Our cloud providers hold SOC 2 Type II and ISO 27001 attestations; BuilderPad itself is not yet independently certified. Every provider is listed on our subprocessor page.
Data is encrypted in transit with TLS and at rest by our cloud providers. Vendor bank account and routing numbers are additionally encrypted at the field level and shown masked in the app. Secrets are kept out of source control.
Access to production systems follows least-privilege principles and is limited to the people who need it for their role.
Every change is reviewed, tested, and run through automated checks - lint, type-check, unit and integration tests, and dependency scanning - before it reaches production.
Automated backups, health monitoring, error tracking, and alerting keep the platform observable. If we confirm a breach affecting your data, we notify you within 72 hours.
Team members and contractors sign confidentiality agreements. Production data access is granted on a need-to-know basis and revoked when roles change.
Uptime monitoring and error tracking run continuously, and key financial records keep a full change history.
Project, financial, and homeowner data is isolated per builder account. We do not sell personal information, and we never use your data to train AI models. We may create de-identified statistics combined across at least 10 companies, as described in our Terms of Service. On termination, customer data is returned or deleted as set out in our Data Processing Agreement.
BuilderPad supports obligations under CCPA/CPRA and other US state privacy laws. Our Data Processing Agreement applies to every customer automatically and is published on this site.
BuilderPad supports privacy obligations for builders working with homeowner, project, vendor, and financial data. We keep the paperwork direct, current, and available during procurement.
The rules governing use of the Service.
Read termsHow we collect, use, and protect information.
Read policyBuilt on the Common Paper standard. Applies to every customer automatically.
Read DPAEvery third party that processes customer data, and what it does.
View listFound a vulnerability? Email us and we'll acknowledge within two business days, triage, and keep you updated through remediation.
security@builderpad.comBuilderPad runs on AWS in the United States. BuilderPad Finance runs on Porter, with file storage on Microsoft Azure. Our full subprocessor list, including AI and payment providers, is published at builderpad.com/subprocessors. Our marketing site is hosted on Vercel.
Single sign-on is on our roadmap for team and enterprise plans. If SSO is a requirement for your procurement process, email security@builderpad.com and we'll share current timing.
Yes. Our Data Processing Agreement, built on the Common Paper standard, applies to every customer automatically under our Terms of Service and is published at builderpad.com/dpa. For a countersigned copy, email privacy@builderpad.com.
You can export your data at any time, and for 30 days after your subscription ends we will provide an export on request. After that, we return or delete customer data as set out in our Data Processing Agreement, subject to limited retention required by law.
Yes - email security@builderpad.com with your procurement or vendor-review questionnaire and we'll turn it around within a few business days.
Email security@builderpad.com with as much detail as you can share. We appreciate responsible disclosure and will acknowledge receipt within two business days.