How BYOB keeps your money and your records safe

Milestone payments haven’t launched yet. When they do, they’ll work like this:

• Deposits are held by a regulated, PCI DSS Level 1 payment partner. BYOB never holds client funds and never stores card numbers.
• Money for a milestone is released only after the homeowner approves the work, backed by timestamped photo proof.
• Alberta’s 10% lien holdback is calculated on every release and kept back until the lien period ends.
• Disputed amounts stay held while the dispute is resolved.

In place on the BYOB platform today:

• Encrypted at rest with AES-256 and in transit with TLS (TLS 1.3 where your browser supports it).
• Our database (Supabase) and hosting (Vercel) providers hold SOC 2 Type 2 attestations.
• Row-level security in the database: you only see the projects you’re a member of.
• PDFs opened in the Design Center stay on your device; files sent to AI Takeoff are checked and discarded, never stored.
• We don’t sell personal information.

Built into the platform’s records, so a disagreement can be settled on facts:

• Site photos are stored with the device’s capture time and a SHA-256 fingerprint chained to the previous photo, so any edit or deletion is detectable.
• Change orders and disputes are append-only: once logged, they can’t be edited or deleted.
• Financial ledgers are append-only and kept in whole cents; corrections are separate, visible entries.
• Trades and helpers can’t be dispatched until their WCB coverage and required safety tickets are on file.
• BYOB never marks up labour or materials; any BYOB fee appears on its own receipt.

Where each claim comes from:

• Encryption and SOC 2 Type 2 refer to our infrastructure providers’ published attestations, not an audit of BYOB itself.
• BYOB hasn’t completed its own SOC 2 audit yet; we’ll publish the result here when we do.
• Card payments will be processed entirely by a PCI DSS Level 1 payment provider, so card details never pass through BYOB’s servers.