Data, security and AI
What ConstructINS does with your project data, and how its AI is used — as the platform actually works.
Data and security
Each person sees only their own projects
Every account has one of 47 job roles and a list of projects. Every page and every request checks both, every time. Client and auditor accounts can read but never change anything. When access ends or is withdrawn, it stops at once.
Sign-in
Passwords are kept only as scrypt hashes, never as text. Passkeys are supported. A temporary password lasts 7 days and must be replaced at the first sign-in. Sign-in attempts are limited. A session is a signed cookie the browser’s scripts cannot read, and it lasts at most 12 hours.
Keys and passwords kept encrypted
The AI service keys, the mailbox password and the credentials for connected systems are encrypted on disk (AES-256-GCM) with a key held by the server.
A record of who did what
What administrators do is written to a log that is only ever added to. Every change to a project record keeps who made it, when, and the value before and after. Files can be downloaded only by accounts allowed to export.
Where your data lives
On the server your ConstructINS runs on, in its own data folder. The administrator can take a backup from Admin. A project can be archived, and deleted for good only after its name is typed to confirm.
Cookies
Only the ones the platform needs to work: your sign-in, your language, the projects you selected, the company sign-in steps, a download notice and which of two homepage versions you were shown (A or B, nothing else). No advertising or tracking cookies.
How the AI is used
The AI helps; people decide
It reads documents, drafts letters and reports, checks figures and suggests. Approvals, awards, payments, contract positions and safety instructions stay with a qualified person.
ConstructINS’s own AI models
ConstructINS runs on its own AI models, fine-tuned on construction work, with the strongest model for each task: reading documents, handwriting from the site, the hard questions and the quick replies. Leading language models are used only where they improve a result, under the same checks.
What is sent to it
Your question and the parts of the records your account may see that bear on it — not the whole database. A file you add to a chat is read for that chat.
Where it goes
To ConstructINS’s own models, on the servers your deployment runs them on. A task that uses an outside language model may be processed outside Egypt, under that service’s terms: the one part of your data an Egypt-hosted or on-premises deployment can send out. A deployment can keep every task on ConstructINS’s own models.
What runs without a model
Registers, dashboards, rule-based checks, BOQ arithmetic, reports and spoken or typed site updates run on ConstructINS’s own engines, with no AI model involved. Reading scanned paper, drafting and Ask ConstructINS use the AI models.
What it never does
It never changes a record without a person confirming what it will file. It never sends anything outside the platform: letters, RFQs and reports are downloaded and sent by people. A read-only account’s AI can only read.
Its limits, and how they are checked
It can misread a document, miss context or use old figures. So every answer names its sources and says when the records do not hold the answer. A risk it reads in a tender must quote the tender’s words, and a rate it reads in an offer must appear in the offer, or it is dropped. Check important figures before you act. It is not engineering, legal or financial advice.
What not to upload
Passwords, personal data you may not share, and documents you have no right to share. Check your contracts’ confidentiality terms before adding a client’s files.
Reporting a security issue
Tell the administrator of your ConstructINS, or reach us through the contact form on the homepage. Please do not make it public before we have had time to fix it.