Security & data residency

Two hosting regions

Keystonas runs as two separate, complete deployments. When an organization is created, it picks one, and that choice is fixed. The organization's database, files, backups, encryption keys and logs all stay in that region.

Who can see what

• Accounts are invitation-only: people join a project when one of its admins invites them.
• Each project member has one role: Admin, Engineer, Inspector or Viewer. Viewers can only read, and can download reports only if an admin allows it.
• Permissions are checked on the server for every action, and again by the database itself (row-level security), so one organization can never read another's data, even through a faulty query.
• Files such as drawings, photos and documents are private. Every download is checked against the project's members.
• Admins can deactivate a member at any time; access stops immediately.

How data is protected

• All traffic is encrypted in transit (HTTPS), and the browser is told to use HTTPS only.
• Data is encrypted at rest by Google Cloud: databases, files and backups.
• The database is reachable only from the application on a private network, not from the internet.
• Passwords are stored as salted hashes, never in plain text. Sign-in links sent by email expire.
• Pages may not be embedded in other websites, which blocks click-jacking.
• Application logs record identifiers and timings, not names, emails or document contents.

AI document reading

On the Global region, an organization can turn on reading of WIR, NCR, SOR and RFI documents with Claude, made by Anthropic. It is off until an admin enables it, and the KSA region cannot enable it.

• A document is sent for reading only when a person clicks Read with AI for that document.
• Only that document and the list of the project's room numbers and trades are sent, so rooms can be matched.
• The result is a suggestion: nothing in the project changes until a person reviews and saves it.
• Use is limited per person per hour, and every reading is recorded in the audit log.

Backups and recovery

• The database is backed up every day, and 30 daily backups are kept. Any moment in the last 7 days can be restored.
• Replaced or deleted files are kept for 30 days before they are removed for good.
• Deleted rooms, photos and progress entries are kept in the database and can be restored by us on request.
• Backups stay in the same region as the live data.
• Admins can export a full copy of a project (JSON) or its room list (CSV) at any time.

Audit trail

Every change is recorded with who made it, when, and what it was before and after: statuses, progress entries, reviews, documents, rooms, drawings and members. Project admins can read the change log for the whole project or for a single room, and nobody can edit or delete it from the application.

Reporting a security issue

If you believe you have found a vulnerability, please email security@keystonas.com or use the contact form and choose “Security”. Please don't access other people's data or disrupt the service while testing. We will reply and keep you informed while we fix it.