Skip to content
DrawPrep

SECURITY

How DrawPrep protects your billing data

Your schedule of values, retainage and change orders are commercially sensitive. Here is exactly how they are held, who can reach them, and what we are not claiming.

Security answer sheetData processing agreementPrivacy policyTrust center

Last reviewed 28 October 2026. No third-party security certification is claimed on this page.

What is protected, and how

Who can reach your data

Access is decided by the database, not by the browser. A signed-in person can only read rows their workspace membership entitles them to, so a tampered request cannot widen the view.

  • Every table is protected by row-level security, with rules that check workspace membership on each query.
  • Access rules apply to signed-in users only. There is no anonymous read path to any workspace table.
  • People join a workspace by invite, and a workspace owner or billing contact approves the join.
  • A person who is removed from a workspace loses access immediately; nothing is cached on our side.

Roles and least privilege

Being on a project does not automatically mean being able to change it. Permissions are separated so routine work cannot become a billing change.

  • Project roles are viewer, editor and submitter; the workspace owner has full access.
  • Viewers can read pay applications but cannot edit them or add change orders.
  • Editors can prepare drafts and record change orders but cannot submit.
  • Only submitters can move an application into a submitted state, and the database enforces this, not just the interface.
  • Only workspace owners can start or change a subscription.

Files and attachments

Subcontract agreements, notices and lien releases are usually the most sensitive things in the account, so they get their own handling.

  • Uploads live in private storage that is not world-readable and is not served from a public URL.
  • Opening a file issues a short-lived signed address that expires in about five minutes.
  • Uploads are limited to 20 MB and to PDF, PNG, JPG, CSV and XLSX.
  • Files are checked by extension, by declared type and by their actual signature, so a renamed file is rejected.
  • Deleting a record also removes the stored file.

Audit trail

The billing record has to be defensible later, which means it cannot be editable after the fact.

  • Status changes on a pay application are written to an event log by the database, not by the browser.
  • That log is append-only from the application: there is no update or delete path for it.
  • Bulk actions are applied through a single database operation that checks permission before changing anything, so a partly-applied batch cannot be left behind.
  • Administrative actions are recorded in a separate log that only an administrator can read.

Payments

DrawPrep does not touch card data. Checkout and card details stay with the payment processor.

  • Card information is entered on the payment processor's own hosted checkout, never in a DrawPrep form.
  • DrawPrep stores the processor's customer and subscription references, the plan and the billing period, not card numbers or security codes.
  • Subscription changes are confirmed by a signed callback from the processor rather than by the browser.
  • Only workspace owners can open checkout or the billing portal.

Sign-in and account safety

Passwords are managed by the authentication service; DrawPrep application tables do not hold them.

  • Email and password sign-in, plus Google sign-in for work accounts.
  • Sign-up and password-reset messages are sent from a verified sending domain, so a lookalike domain cannot pass as us.
  • Addresses a sign-in or checkout flow may return to are restricted to DrawPrep and its hosting domains, which blocks open-redirect tricks.
  • Administrator access is a record in a protected table with no write path from the application, so nobody can grant it to themselves from the product.

Exports

Exports are a common way to smuggle instructions into a spreadsheet, so output is sanitised.

  • Text exported to CSV that would otherwise be read as a formula is prefixed so the spreadsheet shows it as text.
  • Exports are produced from data the requesting person is already permitted to see.

Who we share data with

These are the services DrawPrep depends on to operate. Each is named with the reason it is there.

ServiceRoleWhy it is used
Lovable CloudHosting and managed databaseRuns the application and stores workspace data, including uploaded files in private storage.
StripePayment processorHosts checkout and the billing portal, stores card data, and handles subscription and invoice management.
GoogleSign-in and search toolingProvides optional "Sign in with Google", and Google Search Console is used to monitor search performance.
Lovable transactional emailEmail deliveryDelivers sign-up, password-reset, invitation and notification messages from the verified drawprep.com sending domain.

Common security questions

Do you hold customer data?

Yes. DrawPrep stores the account details needed to run the workspace (name, email, role), the billing records the customer enters (schedule of values, pay applications, change orders, retainage), and the files they upload. We do not store payment card data.

Who can see a customer's data?

Only signed-in people in that customer's workspace, at the permission level their role allows. Access is enforced by the database on every query rather than by the application alone. DrawPrep staff do not browse customer workspaces as routine.

Can an employee or a tampered request widen access?

No. Row-level security checks workspace membership for each query, so a request that asks for another workspace's rows is refused by the database even if the application is bypassed.

Do you store payment card details?

No. Checkout is hosted by our payment processor. We keep the processor's customer and subscription references, the plan and the billing period.

Are uploads protected?

Files sit in private storage with no public URL. Opening one issues a signed address that expires in about five minutes. Uploads are capped at 20 MB and restricted to PDF, PNG, JPG, CSV and XLSX, verified by file signature rather than by name.

Is there an audit trail?

Yes. Pay-application status changes are recorded by the database in an append-only event log, and administrative actions are recorded separately. Neither can be edited or cleared from the application.

Who can change the billing?

Only a workspace owner. Starting a subscription, switching plans and opening the billing portal are all restricted to that role.

Which third parties are involved?

Our hosting and database provider, our payment processor, Google for optional sign-in, and our email delivery service for account and notification messages. Each is listed with a purpose below.

How is data deleted?

A workspace owner can remove projects, pay applications and files from the product, which also removes the stored file. To delete an account and its remaining data, write to us and we will confirm when it is done.

Are you SOC 2, ISO 27001 or GDPR certified?

No. DrawPrep is not certified against SOC 2, ISO 27001 or an equivalent framework, and we do not claim to be. We are happy to answer your questionnaire in writing and to sign a data processing agreement.

What is the breach notification commitment?

If we become aware that customer data in our custody has been accessed without authorisation, we notify affected workspace owners by email without undue delay, with what we know and what we are doing about it.

Who is the contact for security questions?

sales@drawprep.com. We answer questionnaires and handle security reports and deletion requests there.

Need this as a document? The answer sheet is a one-page summary you can print, save or forward. Security reports, questionnaire requests and deletion requests: sales@drawprep.com.

YOUR NEXT BILLING PERIOD

Put the paperwork in one place.

Keep the project, the progress and the package together.

Start your workspace