Construct-it runs on Supabase, a managed PostgreSQL platform. Every table is protected by row-level security: the database itself enforces that each organisation can only ever see its own data. This isolation applies on every single query — it is not something application code can forget to check.
The Xero connection uses OAuth — you authorise it from your own Xero login, and you can revoke it at any time from either side. We never see or store your Xero password.
The connection is read-focused: Construct-it reads invoices, contacts and bank data to keep your projects in sync. Writes to Xero (such as creating an invoice from a progress claim) only happen when you explicitly click the button to do so — never automatically in the background. OAuth tokens are stored encrypted.
Subscription payments are processed by Stripe. Your card details go directly to Stripe and never touch Construct-it's servers — we can't see them, store them or lose them.
Uploaded files (claims, drawings, payment summaries) are kept in private storage buckets. They are not publicly accessible — access is granted through short-lived signed URLs issued only to logged-in members of your organisation.
Access inside your organisation is role-based: owner, admin, project manager and viewer roles each have defined permissions, so you control who can edit financials versus who can only view them.
Construct-it is Australian-owned and built for Australian construction businesses.
If you have a security question we haven't answered here, email info@construct-it.au and we'll give you a straight answer.