Your WIP schedule is the most sensitive document in the company. We treat it that way.
A plain description of how Project Financials stores and protects your data. If your surety, bank or IT consultant needs more detail, write to kevin@krselectric.net and we will answer their questionnaire.
Your company's rows are walled off in the database itself
Every business table carries a company id and PostgreSQL row-level security is turned on for all of them. The application connects as a role that cannot bypass it, and sets the active company on each request. A query for another company's project returns nothing, even if the application code had a bug. Our own operator tools use a separate role and every use of it is written to an audit row.
Encrypted in transit and at rest
All traffic to the site, the app and the API is HTTPS with certificates issued and renewed automatically. The database volume, backups and exports at rest are encrypted with AWS-managed keys.
Passwords are hashed with Argon2id
We never store a password. Hashes use Argon2id, the current recommendation of the password-hashing competition and OWASP. Sessions use short-lived access tokens with rotating refresh tokens in secure, HTTP-only cookies; sign-in, sign-up and reset endpoints are rate limited.
Backed up every night
A full database dump runs nightly and is copied to a separate, versioned S3 bucket in the same region. Restores are tested as part of release. Month-end WIP snapshots you take in the app are stored as their own rows and are included.
Hosted in the United States on AWS
Production runs in AWS us-east-2 (Ohio). Data does not leave the US. Access to the servers is by SSH key from a short allow-list of people, and the database is not reachable from the internet.
Your data is yours: export everything, or delete everything
Any owner can export every table as Excel or CSV from Settings, on every plan, with no waiting period. If you close your account we keep the data 30 days in case you change your mind, then delete it, backups included on their normal rotation.
We do not train anything on your data
Your projects, draws, costs and forecasts are used to run the app for you and for nothing else. We do not sell them, share them with other customers, or use them to train models.
Roles limit what each person can see
Owners, admins, PMs, field users and viewers each see only what their role allows, and field and viewer roles only see the projects assigned to them. On Business every change is in the audit log with who, what and when.
What we do not have yet.
Project Financials is a small company. We do not hold a SOC 2 report today; the controls above are the ones we run, and we will say so plainly rather than imply otherwise. Single sign-on is available on Enterprise. Two-factor authentication for all accounts is on the roadmap.
Found a vulnerability? Email kevin@krselectric.net with the subject line “Security”. We respond within two business days and will credit you if you want us to.
The legal detail is in the privacy policy and terms of service.
Produce your first WIP schedule this week.
Fourteen days, full Professional features, no credit card. Import your projects from Excel, enter the draws and costs you already have, and hand your bonding agent a schedule you can stand behind.