Security & trust

What actually protects your project data — and where we're still building.

Encryption in transit and at rest

All traffic runs over TLS. Data at rest is encrypted by Google Cloud infrastructure — the same encryption model backing Firestore and Cloud Storage for every customer.

Server-enforced data isolation

Every record is scoped to an organization and project ID, and that scoping is enforced by Firestore Security Rules on the server — not just hidden in the UI. A user's client can't read or write another organization's data no matter what the app displays.

Role-based access control

Owner, Admin, PM, Foreman, and Subcontractor roles carry different capabilities, enforced the same way in the rules layer as in the UI — a restricted role can't route around the interface to do more than they're permitted.

Full activity audit trail

Every meaningful action — task changes, approvals, RFI responses, budget edits — is logged to a per-project activity feed with who, what, and when, visible to your team.

Payments handled by Stripe

Card details never touch our servers. Checkout and billing run through Stripe, which is itself PCI-DSS Level 1 certified.

Sign in with Apple & Google

SSO via Apple and Google today, so credentials are managed by providers built for it rather than a password we store ourselves.

Where we're still building

We'd rather tell you what's not done than let you assume it is.

We are not yet SOC 2 or ISO 27001 certified as a company. Our infrastructure runs on Google Cloud Platform and Firebase, which themselves hold SOC 2, ISO 27001, and PCI-DSS certifications — but that covers the infrastructure layer, not an independent audit of Oversee's own application and processes. If your organization requires vendor-level certification, tell us — it affects our roadmap.
We don't run a bug bounty program yet. If you find a security issue, email us directly and we'll respond.
SAML / enterprise SSO (Okta, Azure AD) isn't built yet — it's on our roadmap for organizations that require it. Apple and Google Sign-In are available today.

Questions about security or compliance?

Talk to us directly — especially if a specific certification is a hard requirement for your organization.