Security Overview

Nudgy is a cloud-hosted service that cross-references construction drawing revisions against a project specification and returns cited findings. In data terms, you connect two kinds of document — a specification PDF and drawing PDFs — and Nudgy produces a third artifact: a permanent, citation-backed audit record. Everything below is about how those documents move, where they rest, who can reach them, and what leaves our control.

The service runs entirely in managed cloud infrastructure. There is no Nudgy agent installed on a workstation, no browser extension, and no dependency on any individual's machine — a running audit does not touch, and cannot be interrupted by, an employee's laptop.

Nudgy is composed of a small number of managed services, each with a single job. None of them holds your documents outside the boundaries described here.

• Application (Vercel). Serves the web app and the API your browser talks to. It holds request traffic and session data, not your document stores.
• Database, file storage, and authentication (Supabase). A managed PostgreSQL database (with the pgvector extension for the spec index), private file storage for your PDFs, and the identity provider for sign-in.
• Document-processing workers (Railway). Isolated workers that extract schedule tables from drawings and run the audit. They read a file from storage, process it, and discard their working copy.
• Job queue (Railway Redis). Coordinates audit jobs between the app and the workers. It carries job references, not document contents.
• AI providers (Anthropic and Voyage AI).Anthropic's Claude models perform the audit reasoning; Voyage AI produces the embeddings used to retrieve relevant spec sections. Both are used under commercial API terms — see section 9.
• Email (Resend). Sends transactional and authentication email only (sign-in, password reset). It never receives your documents.
• Microsoft Graph (optional). If you choose to add files from Microsoft 365, a read-only Graph connection fetches only the files you pick — see section 4.

The authoritative, living list of these providers, the data each handles, and where it processes that data is maintained on our Subprocessors page.

Following a single document from arrival to rest is the clearest way to understand the security model.

1. Add. A project owner uploads a PDF, or picks one from OneDrive/SharePoint through the read-only Microsoft 365 picker. In either case the file is written directly to a private storage bucket scoped to your organization.
2. Index (spec only). A worker reads the specification, splits it by CSI section, generates embeddings, and stores the indexed text in the database against your organization. The spec is indexed once and reused by every audit on that project.
3. Audit (drawings). When a drawing revision is added, a worker downloads a transient working copy, extracts the schedule tables, retrieves the relevant spec sections, and submits that text to the audit model. The working copy on the worker is deleted as soon as the job finishes.
4. Report. The findings — each with a severity, an explanation, and a citation to the exact spec clause — are written to the database and shown in the app.
5. Retain.The specification, the drawing, and the findings are kept in your organization's private storage as the audit trail. This retention is deliberate: in a liability-exposed industry, a finding is only defensible if you can later prove exactly which document version was checked. See section 10 for deletion.

Connecting Microsoft 365 is optional; you can also upload PDFs directly. If you do connect it, the access is deliberately minimal.

Data is encrypted in transit and at rest using current industry standards, inherited from our infrastructure providers.

• In transit. All traffic — browser to app, app to database, worker to AI provider — travels over TLS (HTTPS). Nudgy does not expose any plaintext endpoint.
• At rest.Documents in storage and records in the database are encrypted at rest by the provider (AES-256), with keys managed by the provider's key-management service.
• Secrets.API keys and service credentials are held in the deploy platforms' encrypted secret stores and injected as environment variables at runtime. They are never committed to source control.

Nudgy is multi-tenant, and keeping one customer's data invisible to every other customer is a first-order design constraint, not an add-on.

• Every stored record — spec text, findings, audit runs, files — carries the owning organization identifier, and further a project identifier. A given team sees its projects and nothing else.
• Isolation is enforced on everyread and write by the application's authorization layer, which scopes each query to the authenticated organization before any data is returned.
• File storage buckets are private. Documents are never publicly reachable; access is granted only through short-lived, signed URLs issued to an authorized session.

Sign-in is handled by our managed identity provider (Supabase Auth) over email-based authentication. Sessions are cookie-based and expire; signing out invalidates the session. Access to a project's data requires membership in the owning organization, and platform-operator views (such as cost and usage) are gated separately so that they are never exposed to a customer's own administrators.

Where you connect Microsoft 365, that is a separate, read-only OAuth authorization layered on top of your Nudgy account, as described in section 4.

This is the section most reviewers care about, so it is the most explicit.

Documents and findings are retained as the project's audit trail for as long as your account is active, because the value of the record is that it persists. You remain in control of it:

• You can request deletion of a specific document, project, or your entire organization's data by emailing us; we will action it and confirm.
• On account termination, we delete or return your Customer Content in accordance with the Data Processing Agreement.
• Where a document is replaced (for example, a spec addendum), the prior version is preserved as an immutable earlier version rather than overwritten — so the trail of what was audited against what remains intact.

If you have a legal-hold or defined-retention requirement of your own, tell us during onboarding and we will align to it.

Nudgy's primary data store — your documents, the spec index, and audit records — runs in the United States, in Supabase's AWS US East region (Northern Virginia). The document-processing workers and the AI providers also operate in the United States, and the application is delivered over a global edge network. Files you keep in Microsoft 365 remain in your own tenant's region and are read from there. Because some processing occurs outside your country of residence, cross-border transfers of personal data are governed by the safeguards in our Privacy Policy and DPA, including the Standard Contractual Clauses where applicable. If you have a specific data-residency requirement, raise it with us — we can tell you exactly where your project's data would sit and discuss options.

The managed database is backed up automatically by the provider, and file storage is redundantly held. We rely on these providers' durability and recovery guarantees — which we are happy to share — and can align to specific recovery-time and recovery-point (RTO/RPO) commitments where an engagement requires them.

• Production is deployed to managed cloud infrastructure (Vercel and Railway), independent of any developer's machine.
• Secrets are stored in the deploy platforms' encrypted secret managers, never in code or in the repository.
• Database schema changes are applied as versioned, ordered migrations, so the production schema is reproducible from source.
• We upgrade underlying libraries deliberately, exercising the full pipeline before release, rather than blindly.

We have conducted an internal security review of the multi-tenant boundaries and data-access paths, and we can arrange a deeper third-party review under NDA where an engagement requires it. If you believe you have found a security issue, please report it to contact@nudgy.ca — we take responsible disclosure seriously and will acknowledge promptly.

Every audit is recorded append-only: which drawing revision was checked, which spec version it was checked against, every finding with its severity and citation, and who ran it and when. That record is immutable after the fact — it is the product's core promise, and it doubles as a security-relevant, tamper-evident history of activity on your data. Operational logs (request and job metadata) are retained for troubleshooting and monitoring.

If we become aware of a personal-data breach affecting your Customer Content, we will notify you without undue delay in accordance with our Data Processing Agreement, with the information you need to meet your own obligations, and we will work with you on containment and remediation. Our security contact for all matters is contact@nudgy.ca.

Access to production systems is limited to the people who operate them, on a least-privilege basis, through the infrastructure providers' own consoles and authentication, and is removed when it is no longer needed. We do not sell customer data, and we do not use it for any purpose other than providing the Service to you.

Nudgy relies on the subprocessors listed on our Subprocessors page, each engaged under contract with data-protection and confidentiality obligations no less protective than those we owe you. We update that page, and its date, before a new subprocessor begins processing personal data, and you can subscribe to be notified of changes.

Nudgy itself is not SOC 2 or ISO 27001 certified. It runs on infrastructure that is — Vercel, Supabase, Microsoft, and Anthropic all maintain SOC 2 and/or ISO 27001 programs — and we can provide those providers' attestation reports for your file. If your procurement requires Nudgy's own certification, tell us and we will talk through what you need.

We operate under Canadian privacy law (PIPEDA), with Manitoba, Canada as the governing jurisdiction, and we offer a Data Processing Agreement that addresses GDPR-style obligations, including the Standard Contractual Clauses for international transfers, for customers who need one.

Reasonable questions about what happens when something goes wrong upstream: