Security

Security & plan-file handling

Last updated: October 8, 2026

Your plan sets are your clients' and your own work product. This page describes, in plain terms, what we actually do to protect them. It lists only things that are true of the product today. For the full legal detail, see our Privacy Policy.

What we don't claim. ReadMyBlueprint is a small company. We do not hold a SOC 2 report, ISO 27001 certification or any other third-party security certification, and we do not run a bug bounty program. We would rather tell you that than imply otherwise.

How your plan files are handled

You upload PDF plan sets through the web app over HTTPS. We use them to render pages, extract the vector geometry and text, and compute your takeoff.
Each uploaded plan belongs to the account that uploaded it. Every request to open a plan, a page, a takeoff item or an export checks that the plan belongs to the signed-in account; if it doesn't, the app responds as though it doesn't exist.
Uploaded files are stored on our backend's server storage, and the extracted data and your takeoff are stored in our database. They are not published and have no public link.
Plan files are not sent to our analytics tools. Those tools only see page views and product events such as sign-up or upload started.

Who can see your plans

Other customers cannot. Access from our side is limited to the people operating ReadMyBlueprint, who can reach our hosting and database when needed to run and support the service (for example, to investigate a problem you report). We do not sell plan data or use it to build advertising profiles.

Deleting your data

Delete your account yourself. In the app, the account delete option asks for your password and a typed confirmation, cancels any active subscription, and then permanently deletes your account, uploaded-plan records, takeoff items, material mappings, sessions and API keys.
Export first if you want a copy. The same account panel can export your account data (plan metadata, takeoff items, mappings) as a JSON file.
Want a specific file removed, or confirmation that stored files are gone? Email support@readmyblueprint.com. As stated in our Privacy Policy, we delete uploaded files and takeoff data within 30 days of account deletion, except billing records we must keep for tax and accounting law.

Accounts and sign-in

Passwords are never stored in readable form. They are salted and hashed with PBKDF2-SHA256 (260,000 iterations).
Sign-in sessions expire after 14 days. Password-reset links expire after one hour, and resetting a password signs out all existing sessions.
Login, sign-up and password-reset attempts are rate-limited to slow down password guessing.
Optional API keys, if you create them, are stored only as one-way hashes.

Encryption in transit

The app and its API are served over HTTPS, and the API sends an HSTS header telling browsers to require HTTPS. It also sets standard protective headers (no framing, no MIME sniffing).

Payments

Payments are handled by Stripe using Stripe Checkout. Your card number, expiry and CVC are entered on Stripe's page and never pass through or get stored on our servers. We keep only a Stripe customer reference and your plan status. Stripe notifications to our server are verified with Stripe's signature before we act on them.

Infrastructure

The backend and database run on Render.
The web app runs on Vercel.
DNS and cookie-free aggregate traffic analytics on this site run through Cloudflare.
Transactional email (account and password-reset emails) is sent through Resend.

These providers are listed with their roles in our Privacy Policy.

Monitoring and analytics

Error tracking: we use Sentry to find and fix crashes, with default personal-data collection turned off.
Product analytics: Google Analytics 4 and PostHog measure usage. PostHog session replay masks everything typed into form fields, so passwords and form entries are not recorded.

Report a security issue

If you think you've found a vulnerability or a problem with how your data is handled, email support@readmyblueprint.com with what you found and how to reproduce it. Please don't access other customers' data while testing. We don't offer monetary rewards, but we read every report.

Questions

Questions about how we handle your plans? Write to support@readmyblueprint.com, or read the Privacy Policy.