Data, security and AI
What ConstructINS does with your project data, and how its AI is used — as the platform actually works.
Data and security
Each person sees only their own projects
Every account has one of 47 job roles and a list of projects. Every page and every request checks both, every time. Client and auditor accounts can read but never change anything. When access ends or is withdrawn, it stops at once.
Sign-in
Passwords are kept only as scrypt hashes, never as text. Passkeys are supported. A temporary password lasts 7 days and must be replaced at the first sign-in. Sign-in attempts are limited. A session is a signed cookie the browser’s scripts cannot read, and it lasts at most 12 hours.
Keys and passwords kept encrypted
The AI provider keys, the mailbox password and the credentials for connected systems are encrypted on disk (AES-256-GCM) with a key held by the server.
A record of who did what
What administrators do is written to a log that is only ever added to. Every change to a project record keeps who made it, when, and the value before and after. Files can be downloaded only by accounts allowed to export.
Where your data lives
On the server your ConstructINS runs on, in its own data folder. The administrator can take a backup from Admin. A project can be archived, and deleted for good only after its name is typed to confirm.
Cookies
Only the ones the platform needs to work: your sign-in, your language, the projects you selected, the company sign-in steps, a download notice and which of two homepage versions you were shown (A or B, nothing else). No advertising or tracking cookies.
How the AI is used
The AI helps; people decide
It reads documents, drafts letters and reports, checks figures and suggests. Approvals, awards, payments, contract positions and safety instructions stay with a qualified person.
You choose the AI
The owner chooses the providers in Admin → AI — Claude, ChatGPT, Gemini, and ElevenLabs for voice — and can switch any of them off, let them answer together, and set a monthly spending limit. A deployment can also use the company’s own Azure OpenAI resource, set up with Epsilon.
What is sent to it
Your question and the parts of the records your account may see that bear on it — not the whole database. A file you add to a chat is read for that chat. The provider handles it under its API terms.
Where it goes
Claude, ChatGPT and Gemini may process it outside Egypt. That is the one part of your data an Egypt-hosted or on-premises deployment sends out. With the company’s own Azure OpenAI resource it stays in the region the company chooses, and switching every provider off stops it.
With every provider switched off
Registers, dashboards, rule-based checks, BOQ arithmetic, reports and spoken or typed site updates keep working. Reading scanned paper, drafting and Ask ConstructINS need a provider.
What it never does
It never changes a record without a person confirming what it will file. It never sends anything outside the platform: letters, RFQs and reports are downloaded and sent by people. A read-only account’s AI can only read.
Its limits, and how they are checked
It can misread a document, miss context or use old figures. So every answer names its sources and says when the records do not hold the answer. A risk it reads in a tender must quote the tender’s words, and a rate it reads in an offer must appear in the offer, or it is dropped. Check important figures before you act. It is not engineering, legal or financial advice.
What not to upload
Passwords, personal data you may not share, and documents you have no right to share. Check your contracts’ confidentiality terms before adding a client’s files.
Reporting a security issue
Tell the administrator of your ConstructINS, or reach us through the contact form on the homepage. Please do not make it public before we have had time to fix it.