Builder
Compliance & data
Retention policies, data residency, GDPR / CCPA workflows, and network access
Data residencyUS-EastPrimary · Virginia
Open privacy requests1Erasure, due 2026-06-08
IP allowlist3 rangesOffice, VPN, on-call
Audit log retention7 yearsLender requirement
Retention policiesOrg default
Project documents (plans, contracts, change orders)
Includes signed PDFs, plan revisions, and per-document version history.
12,840 docs · 18.4 GB
Daily logs & field notes
Photos, checklists, and weather snapshots tied to a daily log entry.
2,108 logs · 4.2 GB
Receipts & invoice imagery
Auto-attached after OCR. Bank reconciliation evidence.
$8.4M lifetime spend
Messages & comments
In-app comments on budgets, draws, and tasks. Excludes Slack mirror.
38,420 messages
Deleted-project tombstones
Soft-delete window before permanent purge. Recovery via support during this window.
2 projects in tombstone
Data residencyLocked at provisioning
All primary data, backups, and LLM context for this org live in the selected region. Changing region requires a support-assisted migration.
US-East · Virginia
Primary · SOC 2 Type II · 99.97% SLA
US-West · Oregon
Available · request via support
EU · Frankfurt
Available · request via support · GDPR-aligned
Privacy & subject requests
| Subject | Type | Requested by | Due | Status | |
|---|---|---|---|---|---|
| [email protected] Contractor, ended engagement 2026-04-22 | Erasure (GDPR Art. 17) | Subject | 2026-06-08 | Review | |
| [email protected] | Data export | James Mitchell (admin) | 2026-05-25 | Generating | |
| [email protected] | Access (Art. 15) | Subject | 2026-05-18 | Fulfilled |
IP allowlist
Lock API access (not the dashboard) to your office and VPN ranges. Empty means access from anywhere with a valid key. Mobile field uploads bypass via a separate device-pinned channel.
66.249.64.0/24
Office · Sweetwater HQ
10.84.0.0/22
WireGuard VPN
98.14.221.198/32
James Mitchell · on-call mobile hotspot
Enforce allowlist on API only
Dashboard access stays open (SSO covers it). API requests outside the allowlist return 403 with audit log entry.
Audit log retentionTamper-evident
Audit log retention window
Required by your lender contracts. Older entries are hashed and moved to cold archive.
Stream audit log to external SIEM
Push every entry to Splunk, Datadog, or any HTTPS endpoint. Signed with the same HMAC as webhooks.
Require justification on impersonation
BG support must type a reason and ticket ID before impersonating into your org. Visible to you live and in the export.