Security & trust

Your project data, protected.

Kirby Projects holds the record of how your buildings get commissioned and handed over: your golden thread. We treat that responsibility seriously. Here's how your data is kept secure, in plain terms.

Encryption

Protected in transit and at rest

✓
Encrypted in transit All traffic to and from Kirby Projects travels over TLS (HTTPS). Data is never sent in the clear.
✓
Encrypted at rest Your data is stored in a managed PostgreSQL database that encrypts data at rest, and uploaded files are held in encrypted object storage.

Access control

People see only what they should

✓
Role-based, per project and per module Access is granted per person, per project, and per module: Admin, Edit, View or None: so a contributor on one project can't see another, and people only reach the parts of a project they're authorised to.
✓
Tenant isolation on every request Your organisation's data is separated from every other customer's. Each request is checked against the user's organisation and project membership before any data is returned.
✓
Commercial visibility tiers Procurement adds finer-grained visibility, so sensitive commercial information (tenders, pricing) can be shared at the right level with the right people.
✓
Verified authentication Accounts are protected by email-verified sign-in. Single sign-on (SSO) is available for organisations that require it.

Infrastructure

Built on established, secure providers

We don't reinvent the foundations. Kirby Projects runs on well-known platforms that operate to recognised security standards, hosted in UK/EU data centres. Our sub-processors are:

SupabaseDatabase, authentication & file storage
VercelApplication hosting
CloudflareDNS, CDN & network protection
ResendTransactional email

Data protection

You own your data

✓
UK GDPR by design We process your data only to provide the service. We never sell it. Your project records and compliance evidence remain yours.
✓
Resilience The database is backed up automatically so your records are protected against loss.
✓
Data processing agreement Our Data Processing Agreement applies to every customer as part of the Terms of Service. Sub-processors are listed in its Annex 3.

Found a security issue? We welcome responsible disclosure. Please email security@kirby-projects.com and we'll respond promptly.

Security is an ongoing commitment, and we continue to invest in it as we grow. If you have questions about our practices for a procurement or supplier-assurance review, contact info@kirby-projects.com.