Skip to main content

Security at Clearspan

Your structural calculations, project documents, and sealed deliverables are your engineering work product. We protect them accordingly, and this page explains how. For questions or vulnerability reports, email [email protected].

The basics

Clearspan is a web platform for structural calculations, review workflows, and engineering deliverables. You sign in with your email and password, and sessions expire automatically after a short period. Each firm’s workspace is fully separated from every other firm’s. Access is checked on every request, and roles (client, engineer, reviewer, firm admin) control what each person can see and do. Clients see only their own projects.

AI and your data

Clearspan’s assistant features are powered by Anthropic’s Claude. Anthropic does not train its models on this data. We send only the conversation content and the files you explicitly share with the assistant, never your broader project database. And clearspan does not train models on your data either.

Infrastructure

Your data is hosted in the United States on encrypted, professionally managed cloud infrastructure. All traffic is encrypted in transit, and we apply industry-standard protections against common web attacks, including strict browser security policies and rate limiting on every endpoint. We monitor for errors and abuse, and we don’t use third-party advertising or analytics trackers.

Payments and signatures

We never see or store card numbers. Payments are handled by Stripe, and e-signatures are handled by SignWell. We cryptographically verify the authenticity of every notification these partners send us.

You control your data

Projects and calculations are private to your firm. Clients see only their own projects, and draft calculations on client projects stay hidden from firm staff until submitted. You can download your reports and packages at any time, and request data export or account deletion at /data-request.

Frequently asked questions

Data security

How is my data isolated from other firms?
Every firm’s workspace is separate. Access is checked on every request, and users from one firm can never see another firm’s projects, calculations, or documents.
How are passwords stored?
Passwords are protected with modern, industry-standard hashing. We can never see or recover your password, only help you reset it.
Do you support two-factor authentication?
Yes — two-factor authentication is on by default for every account, using emailed one-time codes. You can switch to an authenticator app (recommended) in your security settings, and if you ever lose the device, a one-time code emailed to your account address gets you back in.
Do you support SSO / SAML?
Not yet. It’s on our roadmap for firm plans. If your firm requires single sign-on, contact us and we’ll keep you posted.
Is my data encrypted?
Yes. All data is encrypted in transit, and stored on encrypted infrastructure at rest.
Have you completed a SOC 2 audit or penetration test?
Not yet. SOC 2 is on our roadmap as we grow. In the meantime we follow industry security best practices and welcome security researchers through our vulnerability disclosure policy.
How do I report a vulnerability?
Email [email protected]. We’ll acknowledge your report within two business days, and we won’t pursue legal action against good-faith security research conducted under this policy.
What third parties process my data?
Anthropic (AI assistant), Stripe (payments; we never see or store card numbers), SignWell (e-signatures), Resend (email delivery), and Sentry (error monitoring, with personal-data sending disabled). We use no advertising or tracking services.

AI

Is my data used to train AI models?
No. Clearspan doesn’t train models on your data, and Anthropic does not train its models on this data either.
What do you send to the AI provider?
Only what you put in front of the assistant: the conversation and the files you attach. Your broader project database is not shared. The assistant reads specific projects and calculations only when you ask it to.
Can I use clearspan without the AI features?
Yes. The calculation, review, and report workflows are fully usable without ever invoking the assistant.

Data storage & retention

Where is my data stored?
In the United States, on professionally managed cloud infrastructure.
Can I export or delete my data?
You can download your reports and packages at any time. For a full data export or account deletion, use our data request page. Deleted accounts are deactivated immediately and scheduled for removal from our systems.
How long do you keep my data?
Engineering records are retained while your account is active, since engineers often need their calculation history for years. If you’d like your data removed, submit a request through our data request page.

We’re here if you need us

Security questions, concerns, or reports: [email protected]. See also our Privacy Policy and Terms of Service.