Security at Buildalytic. Your data stays yours, and you stay in control.

Your company does. Your calls, texts, emails, documents, photos and records belong to you in every deployment mode. We use them to run Brody for your company and for nothing else, and you can export them at any time.

Your data is never sold or used to train models for other companies. A private-model project requires separate written authorization for the dataset, exclusions, providers, evaluation and compute. The agreement defines weight ownership and base-model licenses. Data from Procore and other partner platforms stays out of model training.

No. Your data is processed only to provide Brody to your company. It is held in your organization and filtered to it on every request, it is not used to answer other customers’ questions or populate their knowledge bases, and it is not used to train or tune any model another customer uses. Improvements every customer receives come from our own engineering, testing and synthetic data.

No. Brody improves for your company from your templates, rules, corrections and approved answers, which are stored in your workspace and apply only to your users. Private-model training requires a separately approved dataset and written agreement defining exclusions, compute, evaluation and rights to the resulting weights under the base-model license. The product other customers use is not trained on your data.

In the Buildalytic cloud, companies share one managed database, and every record carries its company. Our servers filter every request to your company, and stored files sit under a separate path for each company. If your rules require a dedicated database and environment, choose a private cloud.

In our cloud, Brody calls shared models from leading AI providers, and each request carries only your company’s data and context. Your knowledge base, rules, templates and history belong to your company alone. Private hosting and privately served models require a separate approved Enterprise scope. Training datasets, model providers, weight rights and base-model licenses are agreed in writing.

Your knowledge base holds only what your company adds or connects, and answers about your work come from those sources with citations. Nothing from another company is ever added to it, and your content is never added to anyone else’s.

No. Brody is Buildalytic’s own software. It uses leading AI models through enterprise APIs and adds the parts your IT team cares about, company isolation, permissions, approvals, the audit trail, your records and the phone and text layer. Companies that need a private model can separately scope authorized training, evaluation and serving under an approved Enterprise agreement.

No. Brody never publishes your data, and it never sends it to consumer AI apps. Content goes only to the providers on our sub-processor list, through business API accounts, for the task at hand.

Brody sends content to AI providers through business API accounts under our policy that providers may not train on it, not through personal consumer accounts. Every request is limited to your company, scoped to what the task needs and logged, and your admins control what Brody can read.

For your company, from your own corrections, templates, approvals and knowledge base, inside your workspace. For every customer, from our own engineering and testing. Improvements for all customers never come from pooling one company’s data into another’s.

Yes, that is the design. Your admin decides which sites, folders, projects and systems Brody may read, so areas such as HR, payroll and legal can stay out of scope entirely. Within that scope, answers from your knowledge base follow each person’s access to the source document, so Brody does not show someone information they could not open themselves.

Your templates, rules, prompts, report formats and configuration belong to your company and are never shared with other customers. Buildalytic owns the underlying Brody software, and general product features remain available to all customers, but your company’s configuration and data stay yours.

Brody cites the source behind every answer so your team can see where a figure came from, and anything that carries legal weight, such as a certified form or a submission to an agency or owner, goes to a person for approval before it is sent. Brody does not submit filings on your behalf without that approval.

Brody does not ask your staff to use any consumer AI app. Your team works through your company number, email and existing systems, and AI processing happens inside the Brody service through business API accounts. We document every AI provider and its data terms for your IT review, and separately scoped Enterprise deployments can place agreed chatbot models, embeddings and document-index processing on customer servers. Your IT team must review the remaining service and provider data paths.

Only a small group of staff who operate, secure and support the service, and only to help your team, fix a problem or keep Brody running safely. Our internal console is locked down and changes staff make to companies, users and call settings are recorded. The security pack names the roles with access.

In the Buildalytic cloud, customer data is hosted in the United States. A separately scoped Enterprise deployment can provide a dedicated environment or place agreed chatbot models, embeddings and document-index components on customer infrastructure. Speech, carriers, integrations, logs and backups require their own data-path review. Worldwide service availability does not mean local data residency. The agreed deployment identifies processing locations and any regional requirements.

Every customer is its own organization. On every request our servers read your company from your signed in account, never from a web address or form field, and filter every record, file and answer to that company. Stored files sit under a path for your company and open only through signed links that expire.

A Django API and a Next.js application accessed through your web browser. Records live in a managed PostgreSQL database and files in private storage, both provided by Supabase, which also runs account sign in. Our application servers and background workers run on Railway. Encryption keys for connector tokens are held in our application configuration rather than a separate key management service. Customer data is hosted in the United States.

Customer data in the Buildalytic cloud is hosted in the United States today. Worldwide service availability does not mean local data residency. The agreed deployment identifies processing locations and any regional requirements. A separately scoped Enterprise deployment can place agreed chatbot models, embeddings and document-index components on customer servers. This does not establish residency for the whole service or its providers.

Your company sets the recording retention period in its agreement and settings. Transcripts, reports, messages, attachments, consent records and audit logs have separate retention requirements. There is no single retention period for every record or provider.

Customer data in the cloud is backed up daily. Production runs on its own database project, separate from development and testing, and our servers refuse to start if they are pointed at the wrong one. Demos and development use fictional data, and staff changes to accounts and call settings are recorded.

No. Our hosting providers run the infrastructure Brody uses, under our accounts and their business terms. Your company owns the data, and only Brody, acting for your company, uses it. Enterprise deployments can separately scope agreed local chatbot models, embeddings and document-index components. Hosting, provider processing, logs and backups still require a full data-path review.

Yes. Data is encrypted in transit with HTTPS and HSTS, connections to our database require TLS, and the database and file storage are encrypted at rest. Sign in tokens for connected systems and export credentials are encrypted again by our application before they are stored.

They are in progress for Enterprise customers, including SAML and OIDC single sign on, SCIM provisioning and company wide MFA and session rules. They are not available today, so ask for the current status before your rollout depends on them. Roles for owners, admins, members and viewers are in place now.

Providers receive only the content a task needs. Our policy is to use them only under business terms that do not let them train their models on your content. Where we control the setting, it is set that way, for example call audio for transcription is opted out of the speech provider’s model improvement program and document reading requests are sent with storage switched off. Zero data retention depends on each provider and plan, and the security pack states where it applies.

The controls described on this page run today, from company isolation and encryption to staff access limits and audit records. The formal SOC 2 audit is on our roadmap, and we post its progress on this page. Until the report is issued, your security team gets our security pack, a completed questionnaire and a security review before contract, including our current testing status.

The standard Platform are hosted. Enterprise can separately scope and quote the agreed chatbot models, embeddings and document index on customer-provided servers. The agreement identifies hardware, GPU serving and inference, training, hosting, support and operating responsibilities before activation. Calls, texts, speech, connected services, logs and backups may still use external providers unless those paths are explicitly replaced. This does not make the whole phone service offline or guarantee regional residency.

On account closure, request an export within 30 days unless your agreement provides a different period. Deletion follows the agreed schedule and applicable legal holds. Provider copies and backups follow their own documented lifecycle, and we confirm the scope of completed deletion on request.

Yes, and we recommend it. Brody’s workflows do not need Social Security numbers, so do not send them. Your admin chooses which sites, folders and projects Brody can read, so HR, legal and payroll folders can stay out of scope. Requests to AI providers are also scanned for identifiers such as Social Security numbers and flagged.

Brody shares only what your company’s rules allow on a call, and routes sensitive topics such as payments, holds and personnel matters to your staff. He does not accept jobs, commit your company or make deals unless your rules allow it.

Brody is built for commercial construction data and is not designed for controlled unclassified information or other controlled federal data today. Please do not send that data to Brody. Keep those projects out of scope, and talk to us about how the rest of your work can use Brody.

Keep restricted projects out of scope, and use the security pack to show clients which AI providers process which kinds of work. Every AI request is logged by feature and provider, so we can answer specific questions about a project.

Our services agreement and data processing agreement set out data ownership, limits on use, confidentiality, incident notice, export and deletion, and we sign a mutual NDA before you share any data. We review security terms with your counsel. No honest vendor can promise perfect security, so we commit to specific controls and tell you plainly what is in place.

Because the controls on this page run today, the gaps are stated plainly, and you stay in control. You own your data, can export it at any time, can choose a private cloud or local AI, and get our commitments in writing before you sign.

Calls fall back to a person or voicemail so your number keeps working when the AI or web service is down. Your team reaches us at support@buildalytic.com.

Yes. Your IT team receives our information security and data protection policies as part of the security pack, together with our sub-processor list and a completed copy of your questionnaire. We expect your review to finish before Brody is given access to any of your company files, and we work to your review process and timeline.

Yes. Many teams begin with redacted samples or fictional data while their IT review runs. Workflows such as daily field reports by phone, crew confirmations and inbound call answering do not need access to your document systems, and connections to your files are added only after your review is complete and your admin grants the specific access.

Our security pack, a completed copy of your security questionnaire, our services agreement and data processing agreement, the current sub-processor list with each provider’s data terms, and a security review call before contract. Enterprise buyers get the pack before the first meeting. It covers single sign on and MFA status and our testing status.