Security & Data

Security at a glance

1. Where your drawings and take-offs are stored

Your account, projects, drawings and results are stored in Ireland, in the European Union, with our database provider: the records in its database, the files in its file storage. That is the place the Privacy Policy and Annex A of the Terms of Service name, and both say the same. The database itself is hosted in Ireland.

The website you are reading is a set of files delivered by our hosting provider. It holds none of your drawings: when you upload one, your browser sends it straight to that file storage.

Two services work on a drawing without being where it is kept:

• The measuring service runs separately from the website. Your browser cannot reach it. Our server functions call it, with an address and a shared key kept on our servers.
• An AI service based in the United States reads the drawing. To be read, your drawings are sent there and processed there.

Every provider that handles your data is named, with what it receives, in the Privacy Policy. The list is kept there so there is one list to keep right.

2. Who can see them

• People in your own company. Everyone signed in to your company's account can see your company's projects. Nobody in another company can.
• Not another customer, enforced by the database. Row-level security is switched on for every table in our live database. Each rule matches a row to the company of the person signed in, and the database reads that company from its own records rather than from your browser. Nobody can change the company or the role on their own account: the only thing a user can edit about themselves is their name.
• Our server functions check you themselves. The ones your browser calls verify who is signed in before they act, and take your company from the database rather than from your browser.
• Our staff. The people who run the service can reach stored data through the database provider's console, using a key that bypasses the row rules above. That key is kept on our servers and is never sent to a browser. Closing an account is done this way, by hand, after we have confirmed the request came from you. Signing up cannot give an account staff rights, no customer account holds the admin or staff role, and everyone with access is bound by confidentiality (Terms, Annex A3.3).

Your files are kept under a folder belonging to your company, opened with your own signed-in session, and never given a public link. Database rules lock each company's files to its own folder, and none of our file storage is public.

3. How long we keep them

We keep your data while your account is active.

Three exceptions, the same three the Privacy Policy states:

• Routine backups. Our database is backed up nightly. Deleted material can persist in those backups until they age out in the normal cycle.
• Billing records. The record of credits bought and used is kept, because an Irish company must keep its financial records. It contains no drawings, no measurements and no project material.
• Operational logs. Technical records of system events can include an email address. They contain no drawings, measurements or project material.

4. Deleting your data, and how to ask

A project: delete it in the app. That removes the drawings and specification documents you uploaded, every file produced from them and the records themselves. It runs on our server: files first, records only once the files are proven gone. If any part cannot be removed, the deletion stops and tells you rather than reporting success.

Your whole account: email contact@teastra.com and ask. We delete it as soon as the request reaches us and we have confirmed it came from you. Closing an account removes every project, drawing, result and file, the same way.

The same address takes any other request about your data: a copy of it, a correction, or a question about this page.

5. Encryption

Your data is encrypted at rest, with AES-256.

Your browser talks to this site and to our services only over encrypted connections. The site's content security policy allows the browser to connect only to this site and to our own services, and only over HTTPS and its encrypted equivalent for live updates. Our servers call the AI service over HTTPS too.

That is all the encryption this page claims.

6. Payment

There is no card payment on this site. Credits are paid for by bank transfer, to our business bank account (Terms, clauses 1.5 and 7.4). No card details are typed in here, and no payment processor receives anything from this site.

We will never ask you to pay any other account. If you receive payment instructions that look like ours but name a different account, they did not come from us: contact us before you pay.

7. Certifications: we hold none

Teastra Estimator does not hold a SOC 2 Type II or ISO 27001 certification. No third party has reviewed its security. We are early, and we would rather say so than imply a review that has not happened. What stands behind this page is the architecture it describes, and we are happy to walk any of it through with your IT people.

There is also no two-factor sign-in yet: an account is an email address and a password today.

8. Telling us about a problem

If you think you have found a security weakness in the Teastra Estimator, email contact@teastra.com and say what you found and how to reproduce it. Please do not run security tests against the service without our written permission. Clause 13.5 of the Terms says the same.

If something goes wrong at our end with your data, clause A3.6 of the Terms commits us to telling you within 48 hours of becoming aware of it.

9. The data processing terms

For GDPR you are the data controller for the material you upload and we are your data processor. The data processing terms are part of the contract already, as Annex A of our Terms of Service. You do not have to ask for them.

This page describes the Teastra Estimator, at estimator.teastra.com. The back-office product at teastra.com is a separate service, with its own sign-in and its own security page.