SECURITY ANSWER SHEET
A one-page summary for a general contractor, IT reviewer or counsel. DrawPrep is progress billing software for trade subcontractors.
DrawPrep
www.drawprep.com
sales@drawprep.com
Reviewed 28 October 2026
Yes. DrawPrep stores the account details needed to run the workspace (name, email, role), the billing records the customer enters (schedule of values, pay applications, change orders, retainage), and the files they upload. We do not store payment card data.
Only signed-in people in that customer's workspace, at the permission level their role allows. Access is enforced by the database on every query rather than by the application alone. DrawPrep staff do not browse customer workspaces as routine.
No. Row-level security checks workspace membership for each query, so a request that asks for another workspace's rows is refused by the database even if the application is bypassed.
No. Checkout is hosted by our payment processor. We keep the processor's customer and subscription references, the plan and the billing period.
Files sit in private storage with no public URL. Opening one issues a signed address that expires in about five minutes. Uploads are capped at 20 MB and restricted to PDF, PNG, JPG, CSV and XLSX, verified by file signature rather than by name.
Yes. Pay-application status changes are recorded by the database in an append-only event log, and administrative actions are recorded separately. Neither can be edited or cleared from the application.
Only a workspace owner. Starting a subscription, switching plans and opening the billing portal are all restricted to that role.
Our hosting and database provider, our payment processor, Google for optional sign-in, and our email delivery service for account and notification messages. Each is listed with a purpose below.
A workspace owner can remove projects, pay applications and files from the product, which also removes the stored file. To delete an account and its remaining data, write to us and we will confirm when it is done.
No. DrawPrep is not certified against SOC 2, ISO 27001 or an equivalent framework, and we do not claim to be. We are happy to answer your questionnaire in writing and to sign a data processing agreement.
If we become aware that customer data in our custody has been accessed without authorisation, we notify affected workspace owners by email without undue delay, with what we know and what we are doing about it.
sales@drawprep.com. We answer questionnaires and handle security reports and deletion requests there.
| Service | Role | Used for |
|---|---|---|
| Lovable Cloud | Hosting and managed database | Runs the application and stores workspace data, including uploaded files in private storage. |
| Stripe | Payment processor | Hosts checkout and the billing portal, stores card data, and handles subscription and invoice management. |
| Sign-in and search tooling | Provides optional "Sign in with Google", and Google Search Console is used to monitor search performance. | |
| Lovable transactional email | Email delivery | Delivers sign-up, password-reset, invitation and notification messages from the verified drawprep.com sending domain. |
DrawPrep is not certified against SOC 2, ISO 27001 or an equivalent framework, and makes no such claim. It is not a lender, a payment processor or a legal advisor; it holds no funds, does not submit applications to a general contractor on a customer's behalf, and does not guarantee approval or faster payment. Lien release and waiver material is not presented as legally sufficient.
