Where your data is held
- In the UK. Constructicore runs on a managed server from 20i, a UK hosting company, in a UK data centre, and that is where the app and your data are held. Payments (Stripe) and any service you connect, such as Xero, have their own arrangements, which our privacy notice explains.
- Certified data centres. 20i operates from ISO 27001 accredited data centres and holds ISO 27001, ISO 9001, ISO 22301 and SOC 2 Type 2 certifications. Its sites have security staff on site around the clock, photo ID and swipe card entry, CCTV, and secure perimeter fencing.
- Network protection. 20i's network includes anti-DDoS protection of over 1 Tbps and a web application firewall that inspects requests for common attacks such as SQL injection and cross-site scripting.
Backups and recovery
- We back up the database every night and keep each backup for 14 days, on top of 20i's own backups, which follow the 3-2-1 rule with fully offsite copies in a different data centre.
- Documents you upload and the PDFs we issue are stored outside the website itself, so they cannot be reached directly from the internet.
- You can export everything in your account at any time, as spreadsheets plus every application PDF as issued, so you always hold your own copy.
Signing in
- Two-factor sign-in with an authenticator app is available to every user, and a company can require it for everyone on its team. Trusted devices can be remembered for 30 days, and recovery codes cover a lost phone.
- Passwords are stored only as one-way hashes, never in a form anyone can read, and repeated failed sign-ins are slowed down to stop guessing.
- Every user has their own login: there are no shared accounts, and every change is recorded against the person who made it.
Keeping companies apart
- Each company's data is kept separate. Every request is tied to the signed-in company, so one customer cannot see another's records.
- Main contractors and their subcontractors see only what they share with each other on a linked package, such as applications, notices and messages. Each keeps a copy of what was shared, which neither can alter afterwards.
- Roles and permissions control what each person in your team can see and do, for example who can submit applications or issue notices.
Protecting data in transit and at rest
- All traffic uses HTTPS (TLS), and browsers are told never to connect without it.
- Keys and tokens for connected services, such as Xero and Procore, are encrypted before they are stored.
- A strict content security policy stops the dashboard loading scripts from anywhere else, which guards against a common class of attack.
- Card and bank details are handled entirely by Stripe. We never see or store them.
An audit trail you can rely on
Changes to applications, notices, payments and settings are recorded with who made them and when. Applications and notices sent from Constructicore keep the time they were sent, the recipients and a record of when they were opened, so you have evidence of service if there is ever a dispute.
Our access to your account
We only look at your account to help you, for example when you ask for support. When we do, it is read only, and it is logged.
If something goes wrong
- We monitor the service continuously and are alerted to errors automatically. Live status is published on our status page.
- If there is a personal data breach affecting your data, we will tell you without undue delay, as our customer terms set out, and report to the Information Commissioner's Office where required.
- Found a security issue? Please email info@constructicore.com and we will respond promptly.
Data protection
- Tecniq Services Ltd is registered with the Information Commissioner's Office, registration ZC184301.
- For the data in your account, you are the controller and we are your processor. Our customer terms include the data processing terms (Schedule 3) and list our sub-processors.
- Sub-processors: 20i (hosting and email delivery, UK) and Stripe (payments). Xero, Procore and Companies House are used only when you connect them.
- Your data is yours: we never sell it, and if you close your account we delete it after 90 days, once you have had the chance to export it.