Security & data
Your project data: where, who, how
A construction project means prices, margins, drawings and potential disputes. Here is where that data lives, who can see it, how it is protected, and how it comes back to you the day you decide.
Where
European Union
Who
Fine-grained permissions
Exit
Free export, door open
Where your data lives
Bimpack data is hosted in the European Union: the Frankfurt and Paris regions. That is the default configuration, not a paid option.
Encryption in transit: all traffic goes over HTTPS (TLS).
Encryption at rest for stored files, with a cloud host established in the European Union.
Daily backups, kept for one week.
Enterprise customers: a dedicated deployment can be considered, with the same product surface.
Who sees what
Access control is the heart of the product, not a checkbox.
Per project and per module
Read, write, or nothing. Finance can be invisible to those it does not concern.
Groups per trade
Structure, MEP, client side. Rights are managed per group, not person by person.
Folder by folder, file by file
Rights are inherited down the tree and can be set right down to a single file shared with one party.
Restrictable budgets
A budget can be limited to specific people or groups.
Invitations carrying their rights
A guest arrives with their groups and permissions, applied on acceptance. Invitations can be revoked.
Client access accounts
Your client can be given access limited to the deliverables that concern them.
Example matrix
What is recorded
Per-project activity log
Creation, edit, move, deletion, with author and date. "Who changed this?" is answered by reading, not by investigating.
Approvals recorded
Who approved which order, and when.
Task history
Changes to a task keep their activity trail, including changes that came from a schedule import.
Reversibility, in writing
How your data leaves
Your models stay IFC, the open format you uploaded them in. Your documents stay your documents.
Data exports in open, standard formats.
No lock-in clause, ever. At the end of the free trial you keep access to the viewer and to your files even without subscribing.
Account deletion is obtained by simply asking support, and takes effect within one week.
Compliance & documents
GDPR: our processing commitments are in our data processing agreement, the DPA, which is public. Consent to the terms is collected explicitly at sign-up, with dated versions.
Report a problem
Think you have found a vulnerability? Write to us mentioning "security": the message reaches the team that writes the code directly, with a reply within one business day. We would rather have one report too many than silence.
Questions this page does not cover?
Your IT department's security questionnaire, public tender requirements, a specific deployment need: send them as they are. A precise answer within one business day, from someone who knows the architecture.