Data processing agreement

The customer is the controller of the data it enters into DrawPrep: schedules of values, pay applications, change orders, retainage, project notes, uploaded documents, and the accounts of the customer's own team. DrawPrep is the processor, handling that data only to provide the workspace the customer has subscribed to.

DrawPrep processes customer data to operate the service: preparing and exporting billing documents, applying the customer's own permissions, running subscriptions and billing, sending the account and notification messages the customer has enabled, and keeping the service secure and reliable.

DrawPrep will not sell customer data, will not use it to market a third party's products, and will not use project financials to train a model that is then offered to others. Where a general contractor, lender or owner needs a report, that is produced from the customer's own data at the customer's request.

DrawPrep maintains technical and organisational measures proportionate to the sensitivity of commercially confidential billing data. The measures in place are described in full at /security and summarised on the answer sheet. In outline:

• Access to every data table is restricted by row-level security that checks workspace membership on each query, so the database rather than the interface decides what a person may read.
• Access rules apply to authenticated users only; there is no anonymous read path to workspace data.
• Project roles of viewer, editor and submitter separate reading from changing from submitting, and the submit restriction is enforced by a database rule.
• Uploaded files sit in private storage with no public address; opening one issues a short-lived signed address, and uploads are size-capped, type-restricted and checked by file signature.
• Pay-application status changes are logged by the database in an append-only event log, and administrative actions are logged separately; neither can be edited or cleared from the application.
• Payment card data is not held by DrawPrep. Checkout and card handling stay with the payment processor.
• The website is served over HTTPS, and addresses that sign-in and checkout may return to are restricted to DrawPrep and its hosting domains.
• Administrative access is a record in a protected table with no write path from the application, so it cannot be granted from inside the product.

DrawPrep does not claim certification against SOC 2, ISO 27001 or an equivalent framework, and nothing in this agreement should be read as such a claim. Where a customer's own framework requires evidence, DrawPrep will answer a questionnaire in writing.

Access to customer data is limited to the people who need it to run or support the service, and administrative actions taken in a workspace are recorded in an audit log that only an administrator can read.

The customer authorises the following sub-processors, each engaged to perform a specific part of the service:

If DrawPrep changes a sub-processor in a way that materially affects the service, it will notify workspace owners by email or on this page before the change takes effect. A customer that objects on reasonable data-protection grounds may raise it at sales@drawprep.com, and where the objection cannot be resolved the customer may end the subscription and request deletion.

The customer is responsible for the lawfulness of the data it enters, for the accuracy of its own billing records, for choosing who joins its workspace and what role they hold, and for keeping its own sign-in credentials secure. A customer should remove a teammate's access when that person leaves; access ends as soon as the person is removed.

If an individual asks the customer to access, correct or delete personal data held in the workspace, DrawPrep will help the customer respond using the product's own controls or, where the product cannot do it, at the customer's request to sales@drawprep.com.

A customer can delete projects, pay applications and files at any time, and deleting a file removes the stored copy. On ending an account, DrawPrep will delete the workspace's remaining customer data on request and confirm when it is done, except records it must retain for tax, accounting, fraud prevention or a live dispute. Billing records needed for invoicing and tax are retained for the period the law requires.

If DrawPrep becomes aware of unauthorised access to customer data in its custody, it will notify affected workspace owners by email without undue delay, describing what is known, which workspaces appear affected, the measures being taken and a contact for follow-up. DrawPrep will not state or imply that an incident has been contained before it knows that to be true.

Rather than routine on-site audits, DrawPrep offers a written security questionnaire response, this agreement, the security overview and the answer sheet. Where a customer's regulator or a material contractual obligation requires further assurance, the parties will discuss proportionate ways to provide it.

This agreement runs with the customer's subscription and ends when the data is deleted under clause 8. Nothing here excludes a customer's statutory rights or DrawPrep's liability for anything that cannot lawfully be limited. It does not change the commercial terms of the subscription except where it expressly does.

Questions and notices: sales@drawprep.com.