TRUST / SECURITY
How SubCada safeguards construction compliance records, vendor certificates, and communication history.
Every single database query is filtered and guarded by PostgreSQL Row Level Security policies at the database engine level, guaranteeing that organizations can never view or access another company's data.
Document files are stored in private cloud buckets with AES-256 encryption at rest. No public URLs exist; downloads require short-lived, cryptographically signed URLs.
Subcontractors upload certificates via high-entropy, 256-bit cryptographic tokens. Tokens are hashed in the database with SHA-256, single-purpose, and automatically expire upon use.
Payment card data is never processed or stored on our servers. All transactions, billing changes, and invoices are handled directly through Polar's certified PCI-compliant systems.
Auditable by design
Document views, uploads, reminders, and membership changes are recorded in your organization’s audit history. Data in transit is encrypted using TLS 1.3.
