Security

Last updated October 10, 2026

Your jobs, budgets, drawings and client records are your business. This page says in plain words how we protect them, and how to reach us if something looks wrong.

What we do today

• Your firm's data stays in your firm. Every record belongs to one company and every request is checked against it. Other companies cannot open your projects, clients, files or reports. We keep automated tests that try to cross that line and fail the build if it ever opens.
• People only see what their role allows. Owners choose what each teammate, client and trade partner can view or change. Sub and client access is limited to the projects you share with them and can be taken back at any time.
• Files are private. Drawings, photos and documents are not on public web addresses. When someone opens one, they get a link that stops working after a short time (15 minutes by default).
• Encrypted in transit. The site and API are served over HTTPS only, and browsers are told to keep it that way.
• Passwords and connected accounts. Passwords are stored as one-way hashes. Access tokens for connected tools such as Gmail, Google Drive and QuickBooks are encrypted before they are saved. Two-factor sign-in and passkeys are available.
• Protection against guessing and abuse. Sign-in, password reset, sign-up and public links and forms are rate limited, and login pages use a bot check.
• A record of changes. Project activity, AI assistant actions and privacy settings are logged with who did what and when. Imports show who ran them and what changed.
• Careful logging. Our server logs leave out passwords, access tokens, and email addresses and phone numbers in free text, so troubleshooting does not spread your data.
• Reviewed changes. Every code change goes through a pull request and automated type, test and build checks before it ships. Database changes are tested on a copy first.
• The AI assistant follows the same permissions as the person asking. It only reaches what that person is allowed to see, and actions that spend money, send messages or delete things need a person to approve them.

More detail on roles, the AI audit log and hosting is in Security at Sitework by Sourcy.

Where your data lives

Records are kept in a managed PostgreSQL database and files in a managed object store (Amazon S3 or Cloudflare R2), both with providers that encrypt stored data. The app runs on Vercel. Subprocessors are named in the Privacy Policy. We use Stripe for payments, and only the integrations you switch on (for example Google, QuickBooks or an email provider) receive your data.

What you can do

• Turn on two-factor sign-in or passkeys for every firm admin.
• Give teammates the smallest role that lets them do their job.
• Remove access for people and trade partners when a job ends.
• Tell us right away if an account or device is lost.

Service status

If the service looks down, email team@sourcyinc.com and we will look into it.

Report a security problem

If you think you found a vulnerability, or you believe your account was accessed without permission, email team@sourcyinc.com with what you saw and how to reproduce it. Please do not access other companies' data, run denial-of-service tests, or share details publicly before we have had a chance to fix the problem. We will acknowledge your report, keep you informed, and not pursue people who report in good faith and follow these rules.

See also our Privacy Policy and Terms & Conditions.