Security.
How a client's record is isolated, how a subcontractor signs without an account, where a person stands between the system and a commitment, and what is not certified yet.
Last updated 13 September 2026 · Great Breads Studio
How we think about it
A construction system of record holds purchase orders, certificates of insurance, pay applications, and the names and addresses of everyone on the job. We treat isolation and access as architecture, not settings. This page says what is in place, what is not yet, and how to ask.
Every client on their own tenant
Each contractor's system runs as its own tenant. Every table that holds client data enforces row-level security in the database itself, so one client's rows are never visible to, mixed with, or derivable by another. Studio staff access is role-gated and logged.
Doors, not accounts
Your subcontractors, architects and owners never create an account. Each reaches one page through one link that does one thing: sign this purchase order, review this submittal, mark this punch item done. The credential is the token in the link. Tokens are stored hashed — we hold a fingerprint of the token, not the token — and are removed from the address bar the moment the page opens so they are not written into history or analytics.
A person between the system and a commitment
Nothing the system does commits money, sends a document to a third party, or signs anything without a person in the loop. Outbound actions run through approval gates, every automated action is logged with what it read and what it did, and the log of what the system was allowed to do on its own — and every time that permission was taken back — is public on this site.
Encryption and secrets
All traffic is encrypted in transit with TLS. Data at rest is encrypted by the database and storage provider. Credentials and API keys live in a server-side vault; nothing of that kind is shipped to a browser.
Payments
Billing runs through Stripe. We never see or store card numbers.
Who runs the pieces
Supabase (database, storage, server functions), Vercel (web hosting), Stripe (payments), Anthropic (document reading), Resend (email), Twilio (SMS and telephony), PostHog (product analytics on our own surfaces only). Each is under contract and does one job. We do not sell data.
Your data, your exit
The record is yours. At the end of an engagement the database can be handed to you, and our copy deleted. Deletion removes the tenant's rows, not just a login.
Where we are honest about maturity
We are not SOC 2 certified. The controls above — tenant isolation in the database, hashed capability tokens, least-privilege keys, approval gates, an audit log — are designed against that bar, and certification is on the roadmap rather than in hand. If your diligence needs something we have not published here, ask and we will answer directly.
Reporting a vulnerability
Found something? Write to studio@greatbreadsny.com with the details. We read every report, respond quickly, and credit good-faith researchers.