Your documents
Files are kept in private cloud storage. They are opened only through short-lived links, never through a public address.
Your account
- Passwords are stored hashed, never in plain text.
- Sign-in cookies are marked HttpOnly and SameSite, so scripts and other sites cannot use them.
- Sign-in, password reset and our public links limit repeated attempts.
- When you remove a teammate, their open sessions end right away.
- Only the account owner can add or remove people.
Accounts are separate
Each subcontractor's data is isolated from every other account. Every request is checked against the account that is signed in, so nobody can reach another sub's documents, clients or history.
What GCs and insurance agents can see
- A GC or property manager sees only the documents in the send you made to them, through a link made for that send. You can revoke the links you already sent.
- An insurance agent gets a single-purpose upload link for one request. It expires, and it shows nothing else about your account.
- Neither needs an account.
A record you can point to
Uploads, sends and opens are recorded with a time, so you can show what was delivered and when.
The technology behind it
The services that handle your data, and what each one does. Nothing here is a promise about the future: it is what we run today.
File storage: Cloudflare R2
Your uploaded documents live in a private Cloudflare R2 bucket. It has no public address: when you or a GC opens a file, we create a link that stops working after a few minutes.
Account data: MySQL database
Your company details, clients, document records and send history are stored in our MySQL database. Every query is limited to your own account, and passwords are stored only as hashes.
Email: Resend
Resend delivers our emails: expiration alerts, the documents you send to a GC, invitations and password resets. It receives the recipient's address and the message so it can deliver it. Replies to a send go to your own email address.
Payments: Stripe
Stripe handles plans and billing. Card details go straight to Stripe: SUBCREWZ never sees or stores your card number.
Artificial intelligence: none on your documents
SUBCREWZ does not use AI to read, sort or summarize your documents. Nothing you upload is sent to an AI service or used to train a model. If that ever changes, we will say so on this page before it does.
Report a concern
If you think you found a security problem, write to hello@subcrewz.com. Please give us a reasonable chance to fix it before sharing it publicly.