Your data.
Where it should be.

XGrafter runs on our AU-hosted database (AWS Sydney region) (ap-southeast-2). Your data doesn't leave Australia in normal operation.

That's a deliberate choice. Australian trades and contractors shouldn't need to explain to their client why their site photos and contract data are sitting on a US server. If the AU privacy conversation ever comes up on your side, the short answer is: it's here.

Static assets and the marketing surface run behind Cloudflare's edge network — that's a delivery layer for pages, not a storage layer for your data.

All traffic between your browser (or the field app) and XGrafter is TLS-encrypted end to end. Any request that isn't HTTPS is refused.

Data at rest — every row in the database, every uploaded plan PDF, every site photo — is encrypted on disk. Backups are encrypted at the storage layer as well.

Passwords are never stored in reversible form. Authentication runs on our auth service (bcrypt with per-user salts) and session tokens are short-lived.

XGrafter is multi-tenant, but not in a way that means your data is loose in a shared bucket. Every row of every table carries a tenant_id, and Postgres Row Level Security policies enforce that no query — from an admin, an API request, or even a bug in the application code — can return data from another tenant.

The enforcement lives at the database, not at the application layer. That means even if a bug slipped through in the app, the database itself would refuse to serve the wrong tenant's data. Belt-and-braces.

Field users and admin users are further scoped by license (main vs mobile) and by role, so a mobile user physically cannot reach the admin surface even if they type the URL by hand.

The database is backed up daily on a rolling 30-day retention. Point-in-time recovery (down to the minute) is available inside a shorter window for accidental-delete scenarios.

In the vanishingly unlikely event of a full-region failure we can restore from the most recent daily snapshot into a fresh region.

If you accidentally deleted a job (or an employee accidentally deleted a variation on-site) get in touch quickly — we can usually retrieve it without a full restore.

Your data is your data. Full stop. If you cancel — or you just want a copy for your accountant — we export the whole lot to CSV: jobs, cost centres, line items, contacts, quotes, variations, POs, invoices, timesheets, the works.

Standard invoicing PDFs (progress claims, tax invoices) can be re-generated any time, and are also included in the export bundle.

There's no exit fee, no retention hold, no 'give us 60 days notice' clause. If you leave, you leave with your data.

Users are scoped to their tenant, and within the tenant they're scoped by role. Field-only users can't view financials. Admins can view everything in their tenant.

Every action that changes financial data is timestamped and attributed to a user — invoices, variations, POs, quote versions. If a variation gets raised, you know who and when. Useful for post-mortem, indispensable for audits.

We (XGrafter staff) don't casually browse tenant data. Access to production is limited to the engineering lead and used only for support tickets you've explicitly raised.

We treat personal information (client names, contacts, phone numbers, photos of sites) as regulated data under the Australian Privacy Act. We only collect what's needed to run your business, we don't sell it, and we don't feed it into any AI training pipeline.

The AI take-off engine (our AI vision engine) reads architectural PDFs at run-time to produce measurements. Those PDFs stay in your tenant. They are not used to train third-party models.

If you're operating in a jurisdiction with GDPR-style requirements (or dealing with a client who is), the same principles apply: right to access, right to export, right to be forgotten. Contact us — we handle those requests directly.

If you think you've found a security issue — a bug that leaks data across tenants, an auth issue, an injection surface — email us directly at ops@xgrafter.com. Please don't post it publicly.

We acknowledge inside one business day and work with you on disclosure timing. Legitimate reports get credit if you want it, and we're happy to have a real conversation about responsible disclosure.