Security at DesignFlow Build

Construction companies trust DesignFlow Build with estimates, contracts, job costs and employee records. This page describes the controls we have in place today to protect that information. We update it when those controls change.

For a completed security questionnaire, or any question about this page, email security@designflow-build.com.

DesignFlow Build runs on Amazon Web Services (AWS) in the United States, primarily in the US East (N. Virginia) region. We use managed AWS services, including AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amazon Aurora, Amazon S3, Amazon CloudFront and Amazon Cognito, so there are no servers of our own to patch or expose. AWS is responsible for the physical security of its data centers.

• Our website and web applications are served only over HTTPS with TLS 1.2 or higher, and browsers are instructed to use HTTPS for every visit to designflow-build.com (HTTP Strict Transport Security).

• Our APIs are served only over HTTPS.

• Application data in Amazon DynamoDB and files in Amazon S3 are encrypted at rest with AES-256.

• Access tokens for connected accounting systems are additionally encrypted with keys managed in AWS Key Management Service (KMS).

• Sign-in is handled by Amazon Cognito. Users can sign in with a passkey.

• Users can turn on two-factor authentication with an authenticator app from their profile.

• We use Amazon Cognito threat protection to detect and respond to sign-ins with compromised credentials and other high-risk sign-in attempts.

• Each company’s administrators invite and manage its users, and role-based permissions control which modules each user can open.

• Web sessions end automatically after a period of inactivity.

Each company’s data is logically separated. Our services are built to determine which company a request belongs to from the user’s verified sign-in token, and automated tests and code scans in our build pipeline check for cross-company access on every change.

DesignFlow Build is not designed or authorized to store Controlled Unclassified Information (CUI) or export-controlled data (ITAR or EAR). If drawings, specifications or other documents for your project are marked CUI or carry a restrictive distribution statement, keep them in a system your contract authorizes for that information, and use DesignFlow Build for the rest of the project.

Card payments are processed by Stripe, a PCI DSS Level 1 certified payment processor. Card details are entered on Stripe-hosted pages and never reach our servers.

We record AWS account activity with AWS CloudTrail, with log-file integrity validation turned on. We use Amazon GuardDuty, AWS Security Hub, Amazon Macie, IAM Access Analyzer and AWS WAF to detect threats, unintended public access and exposed sensitive data.

We protect application data with Amazon DynamoDB point-in-time recovery and automated Amazon Aurora backups.

Code changes to DesignFlow Build go through automated checks, including static code analysis (GitHub CodeQL), secret scanning, and tests for access control and separation between customers. Our deployment pipeline reaches AWS with short-lived credentials issued per run (GitHub OpenID Connect).

If you believe you have found a security vulnerability in DesignFlow Build, please email security@designflow-build.com rather than posting it publicly. Include a description of the issue, the steps to reproduce it and the impact you expect.

When you report an issue to us, we will:

• acknowledge your report within three business days;

• keep you informed while we investigate and fix it; and

• credit you when the issue is resolved, if you would like us to.

While researching, please:

• test only against accounts you own or have permission to use;

• stop as soon as you reach data that is not yours, do not keep or share it, and tell us what you accessed;

• not degrade our service (no denial-of-service or high-volume automated scanning);

• not use social engineering, phishing or physical attacks against our staff or customers; and

• give us reasonable time to fix the issue before you disclose it.

If you make a good-faith effort to follow these guidelines, we will not pursue legal action against you over your research, and we will work with you to understand and resolve the issue. We do not currently offer paid rewards for reports.

Our machine-readable contact details are published at /.well-known/security.txt.