Sign in

For your IT and finance teams

How Constrix keeps your company's data yours

Constrix holds payroll, bank lines, supplier rates and customer records for more than one construction company on shared infrastructure. This page says plainly how those companies are kept apart, and what we have not built yet.

The short answer

No user of another construction company can see any of your data — not a row, not a name, not a rate.

Most business software separates its customers with a check written in the application code, where one missed line becomes a leak. Constrix puts the rule in the database itself, so it holds even if a screen has a bug or somebody calls the interface directly. The same test that proves it also confirms each role still sees its own company’s data — a check that finds nothing because it silently did nothing would read exactly like a pass.

The controls

Separation between companies
Enforced by PostgreSQL row-level security, not by the application. 168 of 168 company-scoped tables, 730 policies.
Cross-company read attempts blocked
2,016 of 2,016. Every one of twelve staff roles was made to query every company-scoped table for another company's records.
Separation between sites
Staff put on a specific project see only that project's records. Staff on no project list see the whole company.
The buyer portal
A flat buyer sees their own booking, payments and documents. Eighteen checks confirm they cannot reach another buyer's name, price or receipts.
Administrative override key
The key that would bypass all of the above appears nowhere in the application. Verified by search: zero occurrences.
Passwords
Never stored or seen by Constrix. Held only as bcrypt hashes by the authentication service, and checked against known-breached password lists on the way in.
Where it runs
A managed PostgreSQL database and application hosting, encrypted in transit over TLS and at rest by the platform.
If you stop being a customer
Nothing is deleted. The system becomes read-only — everything can still be read and exported, and saving resumes on renewal.

Said plainly

What we do not have yet

A vendor who claims everything is a vendor to check carefully. Here is where Constrix genuinely stands today.

  • No SOC 2 and no ISO 27001. We are an early-stage company and have not been through either audit.
  • No external penetration test yet. The isolation results above are our own measurements against the live system — and we will run them again in front of your team, or let them try the same tests themselves.
  • Aadhaar numbers are deliberately not stored. Neither are photographs or thumb impressions. Constrix holds PAN because TDS requires it, and nothing more sensitive.

An invitation

If your IT team would rather verify this than take our word for it, we will give them a demonstration company with its own logins and let them try to reach another company’s data. That is the test that matters, and we would rather you ran it before signing than wondered about it afterwards.

Ask us for a test account