Data processing and security summary

1. Roles

For the content a workspace uploads or enters (drawings, standards, catalog, prices, customers, suppliers, quotes, budgets, requests for quote), the workspace decides what it is used for, and LumberSet (LavaFocus) processes it on the workspace's instructions, to provide the service. For account, billing, support and website information, we decide how it is used, as described in our privacy policy.

2. What we process, and why

We process your drawings to produce takeoffs: sheets are rendered, read into a building model, and the takeoff is computed from that model. We process your standards and catalog to compute and price the takeoff. We process your customers' and suppliers' details to deliver what you send them and to collect replies. We process nothing for our own purposes beyond running, securing, supporting and improving the service.

3. Where it lives

Drawings, rendered sheets and generated PDFs are stored in Cloudflare R2, private object storage that encrypts data at rest. The database and the application run on a server we control, managed with the Coolify hosting platform. All traffic between your browser, the service and our providers is encrypted in transit with TLS.

4. Subprocessors

We use a short list of providers, each for one purpose. None of them may use your data for their own ends, and none of them may use your drawings to train models unless your workspace opts in.

If we add or replace a subprocessor that will process your content, we will tell workspace owners by email before it starts.

5. Isolation and access

Every record a workspace owns carries that workspace's identity, and every query is filtered by the workspace taken from the signed-in session, never from the request. Staff access is limited to reviewing takeoffs and supporting you, from a separate staff panel with its own sign-in, and reviewers' changes are recorded with a reason. Members of your workspace see what their role allows, and an owner can remove anyone at any time.

6. Retention and deletion

Content is kept while the workspace is open. Deleting a project removes its plan sets, sheets, takeoffs, quotes and requests for quote from live systems; backups age out on a rolling schedule afterwards. Closing a workspace deletes its content and account information, except billing records we must keep by law.

7. Backups

The database is backed up nightly to a separate volume, with daily, weekly and monthly copies kept for a limited time. Drawings in object storage are not duplicated into those backups; they are held by the storage provider under its own durability commitments.

8. Security incidents

If we become aware of a breach that affects your content or personal information, we will tell the owners of the affected workspaces without undue delay, with what we know and what we are doing, and we will notify authorities where the law requires it.

9. What we do not claim

LumberSet is a new product. We do not hold a SOC 2 report or an ISO certification today, and we will not imply that we do. If your business needs a security questionnaire answered, send it and we will answer it honestly. If your business needs a data processing agreement, write to us.

10. More detail and contact

The longer, plainer version is on our security page. Questions, questionnaires and agreement requests: hello@lumberset.com.