Your building's data, kept where it belongs
Isolation between organizations and properties, roles that go down to a single property, and an audit trail for every administrative change.
What is in place
Secure authentication
Argon2id password hashing, short-lived access tokens, rotating refresh tokens with reuse detection, lockout on repeated failures.
Email verification
Self-serve accounts are created only after the email is confirmed.
Server-side authorization
Every endpoint checks permissions on the server. The UI hiding a button is never the control.
Organization isolation
Row-level security in the database keeps each organization's data separate, enforced on every query.
Property isolation
Roles can be scoped to a property. A supervisor in Tower A does not see Tower B unless you say so.
Role-based access control
Permission catalog per module, object, and action. System roles for every persona, custom roles when you need them.
Audit history
Administrative changes are logged with actor, before and after values, IP, and time, including app download configuration.
Secure APIs
HTTPS everywhere, input validation, idempotency keys, signed upload URLs, verified payment callbacks.
URL validation
Configured download destinations are validated before they are saved. The public API only ever exposes active links.
Backups, monitoring, and recovery
Continuous WAL archiving with scheduled full and incremental backups, restore drills, metrics and alerts on every service, and rollback by redeploying the previous version.
- Point-in-time recovery for the database
- Versioned object storage for photos and documents
- Prometheus metrics, alerting, and centralized logs
- Documented runbooks for deploy, backup, restore, and incidents
Security review or questionnaire?
We are happy to walk your IT team through architecture, data flows, and controls. Write to sales@buildingvision.id.
See your building the way your team sees it
Start a 14-day free trial. No credit card required, and setup takes minutes.