Security

Construct-it runs on Supabase, a managed PostgreSQL platform. Separation between customer organisations is enforced by database row-level security, not only by application code. We last verified organisation-to-organisation separation on 15 September 2026, by signing in as members of three different organisations and confirming that none could see another organisation's records.

• In transit: all connections to Construct-it and between Construct-it and third parties (Xero, Stripe) use TLS.
• At rest: your data is encrypted at rest on our database platform.
• Connected-system tokens: your Xero OAuth tokens are encrypted in our database with a dedicated AES-256 key.

The Xero connection uses OAuth — you authorise it from your own Xero login, and you can revoke it at any time from either side. We never see or store your Xero password.

The connection is read-focused: Construct-it reads invoices, contacts and bank data to keep your projects in sync. Writes to Xero (such as creating an invoice from a progress claim) only happen when you explicitly click the button to do so — never automatically in the background. OAuth tokens are stored encrypted.

Subscription payments are processed by Stripe. Your card details go directly to Stripe and never touch Construct-it's servers — we can't see them, store them or lose them.

Uploaded files (claims, drawings, payment summaries) are kept in private storage buckets — they are not publicly listable or guessable. Access is through short-lived signed URLs: to people signed in to your organisation, and — where you choose to send a claim or payment summary to a client or sub-contractor — through a private link you send them.

Construct-it is Australian-owned and built for Australian construction businesses.

If you have a security question we haven't answered here, email info@construct-it.au and we'll give you a straight answer.