Security and your data
Short answers to what contractors ask us most: where the data lives, whether it’s backed up, and who can see it.
Built on independently audited providers
JobFigure runs on providers that are audited every year by outside firms. JobFigure itself is a small company and has not been through its own SOC 2 audit; we chose providers that have, and we keep the list short.
| Provider | What it does for JobFigure | Independent audits |
|---|---|---|
| Supabase, on Amazon Web Services | Database, sign-in, file storage, server functions (AWS Canada Central) | SOC 2 Type 2 |
| Netlify | Hosts the app and this website | SOC 2 Type 2, ISO 27001 |
| Stripe | Subscriptions and card payments | PCI DSS Level 1 |
| Anthropic | AI reading of bids, receipts, and spreadsheets (only when you ask) | SOC 2 Type 2, ISO 27001 |
| Resend | Sends the optional Monday summary email | SOC 2 Type 2 |
Where your data is stored
Your company’s data is stored in a managed cloud database (Supabase) running on Amazon Web Services, in its Canada Central data center. The app also keeps a working copy on each phone or computer so it runs with no signal and syncs when it’s back online.
Encryption
Data is encrypted while it travels between your device and our servers (HTTPS, required on every page) and encrypted while it’s stored (AES-256).
Backups and recovery
- The whole database is backed up automatically every day, and daily backups are kept for about a week.
- We test restoring it. In October 2026 we restored a full backup into a separate copy, checked every table against the original, and had it running in about six minutes. We repeat the test twice a year.
- The company owner can download a full backup of the company’s data from the app at any time.
Who can see your data
- Only your company. Every table in the database has a rule that returns only your company’s rows. Other JobFigure customers can’t see your data, and you can’t see theirs.
- Roles inside your company. Owners, admins, estimators, and bookkeepers see the business side. Crew members and project managers see the work, not your margins, pay rates, or company settings, and that limit is enforced by the database itself, not just hidden in the app.
- Two-step sign-in. Owners and office staff can turn on a code from an authenticator app in Setup, so a stolen password alone isn’t enough to get in.
- Private links you control. A TV dashboard or calendar link shows your company’s information to whoever has the link. You create them, and you can turn any of them off from Settings. Shop TV links never include dollar amounts.
How the app is protected
- The app loads no outside code, ads, or trackers. A strict browser security policy blocks the app from loading scripts or sending data anywhere except our own servers.
- People who aren’t signed in can’t reach any company data. The only public pages (a quote you send a customer, a TV link) go through our server and show only what that link is for.
- Our hosting, database, payment, code, and domain accounts all require two-step sign-in, and the app’s code is kept in a private repository.
Payments
Subscriptions are handled by Stripe. Your card number goes straight to Stripe and never touches JobFigure’s servers.
AI reading
When you ask JobFigure to read a bid, a receipt, or a spreadsheet, that document is sent to our AI provider (Anthropic) to pull out the details, and the result comes back to you. It’s only sent when you ask, and only for that document. Under its commercial terms, Anthropic doesn’t use it to train its AI models.
GPS location
Location is recorded only at the moment a crew member clocks in or out, to show whether they were at the jobsite. JobFigure doesn’t track anyone’s location during the day. If location is turned off on a phone, the clock-in still saves, without a location.
Deleting your data
Email us from the account owner’s address and we’ll delete your company’s data within 30 days, except records we’re required to keep, like billing records. See our Privacy Policy.
Reporting a security problem
If you think you’ve found a security issue, email support@stricklandandco.net with “Security” in the subject. We’ll reply within two business days and keep you updated until it’s fixed. Our contact details are also published at /.well-known/security.txt.
Questions
We answer every message ourselves. Email support@stricklandandco.net or call (770) 990-0859. Businesses doing a vendor review can ask for our one-page security overview.