Security.
How a client's record is isolated, how a subcontractor signs without an account, where a person stands between the system and a commitment, and what is not certified yet.
Last updated 19 October 2026 · Great Breads Studio
How we think about it
A construction system of record holds purchase orders, certificates of insurance, pay applications, and the names and addresses of everyone on the job. We treat isolation and access as architecture, not settings. This page says what is in place, what is not yet, and how to ask.
Every client on their own tenant
Each contractor's system runs as its own tenant. Every table that holds client data enforces row-level security in the database itself, so one client's rows are never visible to, mixed with, or derivable by another. Studio staff access is role-gated and logged.
Doors, not accounts
Your subcontractors, architects and owners never create an account. Each reaches one page through one link that does one thing: sign this purchase order, review this submittal, mark this punch item done. The credential is the token in the link. Tokens are stored hashed, we hold a fingerprint of the token, not the token, and are removed from the address bar the moment the page opens so they are not written into history or analytics.
A person between the system and a commitment
Nothing the system does commits money, sends a document to a third party, or signs anything without a person in the loop. Outbound actions run through approval gates, every automated action is logged with what it read and what it did, and the log of what the system was allowed to do on its own, and every time that permission was taken back, is public on this site.
Encryption and secrets
All traffic is encrypted in transit with TLS. Data at rest is encrypted by the database and storage provider. Credentials and API keys live in a server-side vault; nothing of that kind is shipped to a browser.
Payments
Billing runs through Stripe. We never see or store card numbers.
Who runs the pieces
Supabase (database, storage, server functions), Vercel (web hosting), Stripe (payments), Anthropic (document reading), OpenAI (call and meeting transcripts, document search), Resend (email), Twilio (SMS and telephony), PostHog (product analytics on our own surfaces only), Apple (push notifications to the iPhone app), CloudConvert (document format conversion), Perplexity and Apollo (company and contact research on inquiries), Google and Microsoft (mail and calendar a client connects), Procore (project data a client connects) and Cloudflare (bot checks on public forms, off-site backup storage). Each is under contract and does one job. We do not sell data.
Your data, your exit
The record is yours. Owners and admins can download every record at any time from Settings: one zip with each table as a spreadsheet file, a script that loads it all into any Postgres database, and links to every stored file. When an engagement ends, we delete the client's records on request, except the decision ledger and financial records, which our retention policy keeps for six years.
Where we are honest about maturity
We are not SOC 2 certified. The controls above (tenant isolation in the database, hashed capability tokens, least-privilege keys, approval gates, an audit log) are designed against that bar, and certification is on the roadmap rather than in hand. If your diligence needs something we have not published here, ask and we will answer directly.
Reporting a vulnerability
Found something? Write to studio@greatbreadsny.com with the details. We read every report, respond quickly, and credit good-faith researchers.