Security
Your job costs
stay yours
ExtraWork holds photographs of your sites, the rates you charge and the terms you agreed. That is sensitive commercial material, and we would rather tell you exactly how we treat it than make you ask.
Encrypted in transit and at rest
TLS on every connection, encryption at rest for photographs, voice notes and change-order data.
SSO and directory sync
SAML single sign-on and SCIM provisioning on enterprise plans, so access follows your directory. When someone leaves, they leave.
Role-based access
A foreman sees their jobs. A branch manager sees their branch. Job costs are not company-wide reading material by default.
Audit trail
Every extra keeps who captured it, when, where, who approved it and what changed between the draft and the signed order.
Where we actually are
SOC 2 Type II is in progress, not finished
We are mid-audit. We are not going to put a badge on this page until it is real. If your procurement team needs the current status, the controls we have implemented, or a security questionnaire completed, ask and we will send you where we genuinely are — including the gaps.
If you need a certification we do not hold yet, we will tell you that instead of talking around it.
hello@extrawork.orgStraight answers
The questions
procurement
always asks
Custody is not an abstraction in this industry. You already lock the job box; this is the same question about your numbers.
- Who owns the data?
- You do. Your photographs, voice notes, costs and contract terms are yours. We do not sell them, and we do not share them with other customers.
- Do you train models on our job costs?
- Not on your data. Drafting runs against your capture to produce your change order, and your content is not used to train models for anyone else.
- Where is it hosted?
- In a major cloud provider's regions, with data residency options for customers who need work kept in a specific country.
- Can we get our data out?
- At any time, in a documented export format, without asking us for a favour or paying an exit fee.
- What happens if we leave?
- You export, we delete on a defined schedule, and we tell you when it is done.
Send us your
security review
We would rather answer it now than three months into an implementation.