What we collect

To run Kinnect, we store the data you and your team put into the app. Specifically:

• Account information — your name, email, hashed password, role, and which workspaces you belong to.
• Project data — project names, budgets, schedules, bid packages, RFIs, value-engineering items, cost-history entries, and any custom fields you enter.
• Files you upload — drawings, specs, estimates, bid PDFs, and any documents stored in your Project Documents folders.
• AI conversations — the prompts you send and the responses Claude returns. We track token counts and cost only, not the actual content of your chats (see AI features below).
• Activity logs — who did what, when (for audit + security purposes only).
• Operational metadata — IP address and user-agent at login, for abuse monitoring.

We do not collect cookies for advertising, track you across other sites, sell or share data with marketers, or use your data for any purpose other than running the product you're paying for.

Where your data lives

Kinnect is a thin layer over a few specialist services. We don't run our own data centers — we use trusted infrastructure providers and we list every one of them here.

Each of these is a SOC 2 Type 2 certified vendor. Our data stays inside this list — we don't share it with advertisers, analytics brokers, or any third party not required to deliver the product.

AI features

Kinnect's AI Assistant uses Anthropic's commercial Claude API. Two things about this are worth saying clearly:

Anthropic retains API requests for 30 days for abuse monitoring, then permanently deletes them. They don't sell that data, don't share it with marketers, and they're SOC 2 Type 2 certified.

What Kinnect stores about your AI usage

On our side, we record only metadata for billing and quota tracking:

• Token counts (input and output)
• Computed USD cost
• Model used (e.g. claude-sonnet-4)
• Which user triggered the call
• Timestamp

We do not store the text of your prompts, the AI's responses, or any excerpts from them. If you delete your account, even this metadata is removed.

Bring your own key (optional)

You can plug in your own Anthropic API key from the AI Config screen. When you do, AI calls flow directly to your Anthropic account, bypassing ours entirely. You can verify retention + training settings directly in your own Anthropic Console. The privacy story is the same either way — this just gives you direct visibility.

Security controls

Encryption

• In transit: TLS 1.2+ on every HTTP request between your browser, our backend, and every sub-processor above. No data ever flows over an unencrypted channel.
• At rest: AES-256 on Neon's database storage, Cloudflare R2 file storage, and Anthropic's retention buffer.

Authentication

• Passwords are hashed with argon2id — the modern, memory-hard, GPU-resistant algorithm. We never see, store, or transmit your plaintext password after you set it.
• Sessions use short-lived JWT access tokens with rotating refresh tokens. Refresh-token reuse is detected and triggers an automatic revocation of the whole session chain.
• Password resets use single-use, time-limited tokens delivered via email.

Multi-tenant isolation

Every database query is automatically scoped to your company by middleware running inside our database layer. A query without a company context literally throws an error and is rejected. This isn't a "we promise not to look" arrangement — it's a structural guarantee enforced at the data-access layer.

Audit log

Every significant action — invitations, deletions, role changes, AI requests, file uploads, platform-admin views of a workspace — is logged with the actor's identity and a timestamp. Workspace admins can review their own company's log; we retain platform-level logs to investigate incidents.

Retention & deletion

• Active data stays as long as your workspace is active. Project data, files, RFIs, and so on persist until you delete them.
• Deleted accounts are removed within 7 days of the request, including all memberships, files, and AI usage metadata. Audit-log entries are retained with the user reference set to null — we keep the historical record but no longer associate it with you.
• Database backups are managed by Neon with point-in-time recovery; backup retention is 7 days on our current tier.
• AI request data at Anthropic follows their 30-day window. We can request immediate deletion on your behalf if you ask.

To export or delete your data, email info@kinnect.build with the subject "Data request." We'll respond within 5 business days.

What we honestly don't have yet

We're a small team and we want to be upfront about what we haven't yet built or certified. Some of these are on the roadmap; some aren't relevant for our customer base today. If any of them are a hard requirement for your team, talk to us before signing up.

• SOC 2 Type 2 audit — our infrastructure providers all have one. Kinnect itself does not. We expect to pursue one once we cross enterprise customer thresholds.
• HIPAA / BAA — not signed with any vendor. We do not currently support workflows involving protected health information. Hospital construction projects are fine; patient data is not.
• ISO 27001 — not certified.
• FedRAMP / GovCloud — not supported. Kinnect is not appropriate for classified or CUI-containing projects.
• Customer-managed encryption keys (CMEK) — not supported. All data is encrypted with provider-managed keys.
• Single sign-on (SAML / OIDC) — not yet. On the enterprise roadmap.

Reporting a security concern

If you believe you've found a vulnerability, or you've seen behavior that looks like a compromise, please email info@kinnect.build with the subject "Security report." We treat these as priority responses and acknowledge within 24 hours.

Please don't post vulnerabilities publicly before we've had a chance to fix them. We're happy to credit responsible disclosure in any follow-up notice.