Security at Sitedrive
How Sitedrive protects customer data and runs its platform. Written for IT, security and compliance teams evaluating Sitedrive.
This page describes Sitedrive's platform and security practices as of October 2026. Sitedrive continuously develops its service and may change technical implementations, tools or subprocessors, provided the overall level of security is maintained or improved. Binding commitments are defined in the customer agreement, the General Terms and the Data Processing Agreement.
Company and platform
Sitedrive is a construction planning and scheduling SaaS platform built by Sitedrive Oy, a Finnish company. Construction companies use it to plan, schedule and coordinate work across projects and sites, on the web and on mobile.
All production infrastructure and customer application data reside in the European Union: Google Cloud Platform, europe-north1 region, Hamina, Finland.
Data protection
| Area | How Sitedrive handles it |
|---|---|
| Data location | All customer application data (projects, schedules, work packages and related content) is stored and processed in Google Cloud europe-north1 (Finland), with backups in a second EU region. The exceptions are listed under “Processing outside the EU” below. |
| Encryption in transit | TLS 1.2 or newer on all external connections. Internal service-to-service traffic uses Google's encrypted network. |
| Encryption at rest | AES-256 encryption by default in all data stores. |
| Edge network | All traffic passes through Cloudflare for TLS termination, web application firewall and DDoS protection. Cloudflare does not store request or response contents. EU-only edge processing is available by agreement. |
| Tenant isolation | Logical isolation by account, site and project. Every API request passes a permission check before any read or write. Tenant boundaries are verified by automated end-to-end tests. |
| Data export | Customers can export their core data at any time through the REST API. |
| Data minimisation | Sitedrive collects only the personal data needed to run the service, aggregates or anonymises data where personal data isn't needed, and removes it when it is no longer needed. |
| AI features | Used only if the customer switches them on. The data a feature needs is processed by Google Cloud Vertex AI in the EU and is not used to train AI models. |
Roles under the GDPR
Sitedrive processes all personal data in the service as a processor on behalf of the customer, under the Data Processing Agreement. The customer is the controller. Sitedrive is the controller only for marketing and sales contacts, customer and billing contacts, its website, and sign-ins not yet linked to any customer, as described in the Privacy Policy. Sitedrive has a named Data Protection Officer: dpo@sitedrive.com.
Processing outside the EU
- Sign-in records. Sign-in is handled by Google Firebase Authentication. Email address, user ID and sign-in metadata are processed on Google's global identity infrastructure, including the United States. No project or schedule data is involved.
- Push notifications. Google Firebase Cloud Messaging delivers notifications to the mobile apps on Google's global infrastructure.
- Support chat. HubSpot handles in-app support chat in the United States.
- Edge traffic metadata. Cloudflare processes limited traffic metadata (IP address, URL, time) at its global edge.
These transfers are covered by the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. All other customer data, including application content, application logs, error monitoring, product analytics and transactional email, is processed in the EU.
Sign-in and access control
Passwordless sign-in
Sitedrive does not use passwords, so there are no Sitedrive passwords to steal, phish or leak. Users sign in with:
- Microsoft single sign-on through the customer's Entra ID tenant;
- Google single sign-on through the customer's Google Workspace;
- Sign in with Apple; or
- a single-use, short-lived code sent by email.
With single sign-on, the customer's own multi-factor authentication, conditional access and session policies apply to Sitedrive automatically. Customers who require enforced MFA should onboard their users through single sign-on.
Role-based access control
Customers manage their own users and permissions. Access is controlled at three levels, account, site and project, so each user sees only what their role needs.
Sitedrive staff
Multi-factor authentication is enforced on every path Sitedrive employees use to reach internal systems: Google Workspace with 2-Step Verification, Google Cloud access through Workspace identities and least-privilege IAM roles, and 2FA in all third-party tools. No admin path bypasses MFA. The platform runs on serverless Google Cloud services with no virtual machines, bastion hosts or SSH access.
Secure development
- Every code change is peer reviewed; no developer can merge their own code.
- Every pull request runs type checking, linting, unit and end-to-end tests, and an AI-assisted security review.
- All infrastructure is defined as code (Terraform) and goes through the same review.
- Dependabot monitors dependencies for known vulnerabilities.
- Development, staging and production are separate environments.
- Emergency fixes follow the same review and testing controls on a shorter cycle.
Security testing and vulnerability management
- Continuous application-level penetration testing and attack-surface monitoring with Detectify, evaluated quarterly.
- Google Cloud Security Command Center continuously checks the infrastructure against the CIS Google Cloud Foundations Benchmark.
- Periodic security audits of the codebase and infrastructure: permissions, exposed surfaces, IAM bindings and secret handling.
- Vulnerabilities are logged, prioritised by severity and tracked to resolution.
- Third-party penetration testing is available by agreement.
Logging and monitoring
Sign-in events, API requests, user activity in the application, infrastructure admin actions and security findings are logged centrally in Google Cloud Logging in the EU. Every action in the product can be traced to an identity, including when a credential has been compromised. Request logs are kept for 12 months.
Incident response and breach notification
Sitedrive has a documented incident response plan covering preparation, detection and analysis, containment and recovery, and post-incident review, owned by a named Data Protection Team.
If a personal data breach affects customer data, Sitedrive notifies the customer without undue delay, as set out in the Data Processing Agreement, so that the customer can meet its own notification duties under the GDPR and NIS2.
Backups and business continuity
| Aspect | Configuration |
|---|---|
| Database backups | Automated daily backups, kept for 30 days, stored in the EU |
| Point-in-time recovery | 7-day transaction log window; worst-case data loss is measured in minutes |
| High availability | Regional high availability with automatic zone failover |
| Infrastructure recovery | The full stack can be rebuilt from Terraform; container images are kept in Artifact Registry |
| Disaster recovery testing | End-to-end recovery rehearsals on a recurring schedule |
| Customer duties | None. Sitedrive manages backups. Customers can also export their data through the REST API. |
Compliance
Sitedrive's infrastructure runs on providers that hold ISO 27001 certification and undergo annual SOC 2 Type II audits: Google Cloud Platform, Cloudflare, Firebase, GitHub and HashiCorp Terraform Cloud. Sitedrive checks provider certifications on an ongoing basis.
Sitedrive's own security practices meet the expectations of ISO 27001. Cybermeter, the framework of the Finnish National Cyber Security Centre (NCSC-FI), guides how Sitedrive manages its security programme.
Sitedrive complies with the EU General Data Protection Regulation (2016/679) and the Finnish Data Protection Act (1050/2018). As a SaaS supplier to organisations regulated under NIS2, Sitedrive aligns its controls with the risk-management measures of NIS2 Article 21.
Subprocessors
The providers that process customer data, what they do and where, are listed at sitedrive.com/subprocessors. Sitedrive tells customers about new subprocessors in advance.
Shared responsibility
| Sitedrive operates | The customer operates |
|---|---|
| Hosting, infrastructure and networking | Single sign-on configuration in the customer's identity provider |
| Software development, testing and deployment | User provisioning and role assignment in Sitedrive |
| Monitoring, alerting and incident response | MFA and conditional access policies in the customer's identity provider |
| Backups and disaster recovery | Safekeeping of any API credentials it creates |
| Security patching and dependency updates | Application content: projects, schedules and work packages |
Report a vulnerability
If you believe you have found a security vulnerability in Sitedrive, email support@sitedrive.com with a description and the steps to reproduce it. Please give us reasonable time to fix the issue before you disclose it, and don't access or change other people's data while testing.
More information
Security questionnaire answers, architecture documentation and the Service Level Agreement are available from your Sitedrive contact or support@sitedrive.com.