Security and trust

Where your data lives

Workspace content — projects, budgets, drawings, schedules, messages, uploaded files — is stored in a PostgreSQL database and object store operated by Supabase in the AWS East US (North Virginia) region. The application servers run on Railway. We do not replicate customer data to any other region.

The public website you are reading is a separate system from the application. Its only store of personal information is the contact form, described in the Privacy Notice.

Encryption

Every connection between your browser, our servers, our database and each of our vendors is encrypted with TLS. Stored data is encrypted at rest by our database provider.

How one customer is kept from another

RhettWorks is multi-tenant. Every project, conversation, contact and file belongs to exactly one organization, and that organization is resolved on the server from the signed-in user's session — never from anything the browser sends. Every database query is scoped to it. A request that cannot be tied to an organization is refused rather than answered broadly.

The browser reads the database directly in exactly one place: in-app messaging, where a live feed of your own conversations is delivered over an authenticated connection. Those tables carry row-level security policies that return only the conversations you are a participant in, and only for reading — every write still goes through our servers. Every other table has row-level security switched on with no policy a browser can use: the identity function those policies depend on to match a row to a signed-in user has had its execute permission revoked from every browser-facing database role, so a request that bypassed the application either hits permission-denied or reads nothing at all. A test in our continuous-integration suite fails the build if a new table is created without row-level security enabled.

Within an organization, access is per project and per action. Each person holds a permission template that says what they may read, write or manage in each area, and the same check runs whether the request comes from a screen or from the AI acting for that person.

Sign-in and access

• Invitation-only. There is no public sign-up. An organization's administrator invites each member and can suspend or remove them at any time; removal revokes sign-in immediately.
• Passkeys. Where enabled for an account, members can sign in with a passkey (Face ID, Touch ID, Windows Hello, or a hardware key) instead of a password. Passwords remain available and are handled by our authentication provider, never stored by us.
• Single sign-on. We do not offer SAML or OIDC single sign-on today. Connecting a Microsoft 365 account is an integration for mail, calendar and files; it is not a login method.
• Rate limits. Every route is rate-limited, and the routes that start paid AI work or send mail carry their own tighter per-user limits, so one account cannot exhaust the service for others.

What the AI is allowed to do

Rhett, the assistant, reads your workspace to answer questions and to draft work. A write that changes the project record — a new RFI, an edited budget line, sending an email — is queued as a proposed action that a person reviews and approves or rejects in the app. The approval, who gave it, and what it changed are recorded.

A narrower set of actions applies directly, because the person asked for exactly that and can see the result immediately: an email DRAFT, which is written into your own mailbox and never sent; a file you asked to be uploaded into your own workspace; and project configuration such as a working calendar or a resource list. None of these alters a record another company relies on.

To generate a response, your prompt and the workspace content relevant to it are sent to an AI model provider. Anthropic is the primary provider, and your main conversation with the assistant is pinned to it. Individual background steps — a research or drafting task the assistant delegates to itself while answering you — may fail over automatically to OpenAI, Google or xAI when Anthropic is unavailable; each provider's own terms govern what it does with content it receives. We do not train models on your content ourselves. When the assistant runs a web search on your behalf, the search query is sent to the search engine; your workspace content is not.

The platform is built so administrators can scope which assistant capabilities are available to their organization, including web search.

Backups and resilience

The production database has point-in-time recovery enabled, so it can be restored to any moment within the retention window, not only to a nightly snapshot. Deploys are automated from a single reviewed branch, and a bad release is rolled back by redeploying the previous build in about a minute.

Retention and deletion

Your organization owns its workspace. Content you delete is removed from the application at once; records that form part of a project's legal history (RFIs, submittals, change orders, completed daily logs) are retained by design and can be closed or voided but not silently erased, because they are the record. When an organization leaves, ask us and we will delete its data.

Contact-form submissions on this website have a retention window too; the current term is published in the Privacy Notice, which is the single source for that number.

Logging and audit trail

Every request, every assistant turn and every approved action carries one trace identifier from the browser to the database, so a question about what happened can be answered exactly. Application logs record events and identifiers, not the content of your messages or documents.

Reporting a vulnerability or an incident

Write to info@rhettworks.com with what you found and how to reproduce it. We acknowledge reports within two business days. If we ever confirm an incident affecting your data, we notify your organization's administrators without undue delay, with what happened, what was affected and what we did.

Security questionnaires are answered directly and in writing; send yours to the same address.