Every project is isolated by design.
Project-scoped authorization, enforced inside the database, applied to every Connected Project Record.
CompleteVue is built on multi-tenant isolation, least-privilege permissions, and continuous authorization. Every request is re-evaluated against the specific project being accessed, and every contract, RFI, submittal, invoice, drawing, photo, and uploaded file inherits the same boundary.
ARCHITECTURE
Security Architecture
Every authorization request in CompleteVue follows the same chain. No Connected Record — contract, RFI, submittal, invoice, drawing, photo, or uploaded file — bypasses these boundaries.
- Step 1User
Authenticated identity verified on every request.
- Step 2Organization
Tenant boundary that isolates one customer from every other.
- Step 3Workspace
Portfolio scope grouping projects for a team or business unit.
- Step 4Project
Project membership is checked before any record is released.
- Step 5Connected Project Records
Contracts, RFIs, submittals, and financials inherit project scope.
- Step 6Database Policies
Row-level policies enforce authorization inside the database.
- Step 7Storage
Uploaded documents resolve through project-scoped storage paths.
- Step 8Audit
Significant activity is recorded to an immutable audit history.
An identity is resolved to its organization and workspace, then evaluated against the specific project being accessed. Only after that project-scoped check succeeds do database policies release Connected Records, storage objects resolve, and audit entries record the interaction. The chain is enforced end-to-end — the same policies protect API access, background work, and document downloads.
ACCESS CONTROL
Project security starts with access control.
Every request is evaluated against the specific project being accessed. Authorization is enforced inside the database, applied identically across the platform, and inherited by every Connected Record.
Project-Scoped Authorization
Authorization is evaluated against the specific project being accessed. Membership on one project never implies visibility into another — even inside the same organization or workspace.
Database-Enforced Authorization
Access policies are enforced inside the database itself, so authorization remains consistent regardless of how information is requested — application, API, background workflow, or export.
Connected Document Security
Drawings, RFIs, contracts, photos, specifications, submittals, and uploaded files inherit the same authorization boundaries as the Connected Project Record they belong to. Document paths are project-scoped and evaluated on every request.
Role-Based Permissions
Roles are assigned at three layers — organization, workspace, and project — and combined under a least-privilege model. Every action is re-evaluated at request time through continuous authorization, so permission changes take effect immediately.
Continuous Authorization & Audit
Every access decision is evaluated when the request is made, not cached from earlier sessions. Significant activity — approvals, awards, financial changes, membership changes — is recorded in an immutable audit history for operational accountability.
Shared Companies, Isolated Projects
Subcontractors, vendors, and partner organizations can be reused across projects for procurement and collaboration, while project-scoped authorization keeps each project's information isolated from the others they participate in.
Platform Security
CompleteVue combines modern cloud infrastructure with layered authorization, tenant isolation, and operational controls implemented across identity, data, and operations.
- Secure authentication
- Invitation-only organization provisioning
- Least-privilege permissions
- Role-based authorization
- Database-enforced authorization
- Project-scoped isolation
- Connected document security
- Encrypted cloud storage
- TLS encryption in transit
- Immutable audit history
- Disaster recovery
- Continuous platform health monitoring
- Operational observability
- Rate limiting
- Security monitoring
Shared Responsibility
CompleteVue and your organization each own a defined portion of the security model. The boundary is explicit so IT, security, and operations teams know exactly where their controls apply.
- Infrastructure
- Authorization
- Connected Records
- Storage
- Audit history
- Users
- Project membership
- Password policies
- Internal governance
- Uploaded information
ENTERPRISE
Built for Enterprise Operations
Capabilities implemented in the platform today. Each item below reflects a control that is live and enforced across every customer organization.
Multi-tenant architecture
Each organization operates as an isolated tenant with its own users, workspaces, and projects.
Database-enforced tenant isolation
Tenant boundaries are enforced inside the database, not only in application code.
Project-scoped authorization
Every request resolves to a specific project before any Connected Record is returned.
Connected Project Record security
Records inherit the authorization boundaries of the project they belong to.
Immutable audit history
Significant platform activity is recorded to a tamper-evident audit history.
Disaster recovery
Backup inventory, restore drills, and recovery runbooks are maintained by the platform team.
Operational observability
Health, incidents, and dependency status are continuously monitored across the platform.
Platform Administration separation
Platform administration operates in a reserved control plane, separate from customer organizations.
Invitation-only provisioning
Organizations and users are provisioned through invitations — no anonymous sign-up path exists.
Continuous platform monitoring
Platform dependencies, workflows, and rate-limited surfaces are monitored in real time.
PRINCIPLES
Security Principles
The principles that guide how CompleteVue is designed, built, and operated.
Least Privilege
Users receive only the permissions required for their role on each project. Organization and workspace roles are additive but never override project-scoped authorization.
Project Isolation
Every Connected Record is bound to a project. Membership on one project is never sufficient to access another, even inside the same organization.
Customer Data Ownership
Customers retain ownership of their project information. Tenant boundaries keep organizations, workspaces, and projects logically separated at every layer.
Transparency
Approvals, awards, financial changes, and membership changes are recorded to an immutable audit history so teams have a durable operational record of what happened and when.
HIGHLIGHTS
Enterprise Security Highlights
A quick reference of the platform capabilities that are implemented and enforced today.
- Multi-tenant architecture
- Project-scoped authorization
- Database-enforced access control
- Connected Record security
- Secure document storage
- Immutable audit history
- Disaster recovery procedures
- Continuous platform monitoring
- Operational observability
- Platform Administration separated from customer organizations
- Invitation-only provisioning
- Least-privilege permissions
FAQ
Enterprise Security FAQ
Common questions from IT, security, and procurement teams evaluating CompleteVue.
How is customer data isolated?
Every organization is a distinct tenant. Project-scoped authorization is enforced inside the database, so records from one organization are never returned to another — regardless of how the request is made.
Can multiple companies collaborate securely?
Yes. Subcontractors, vendors, and partner organizations can be reused across projects for procurement and collaboration, while each project remains isolated. Membership on one project never implies access to another.
How are uploaded documents protected?
Drawings, RFIs, contracts, photos, and other uploads are stored in project-scoped storage paths and inherit the authorization boundaries of the Connected Project Record they belong to. Access is evaluated on every request.
How does CompleteVue enforce permissions?
Roles are assigned at the organization, workspace, and project layers under a least-privilege model. Database-enforced policies evaluate every access decision at request time — permission changes take effect immediately.
Who controls user access?
Customer organizations manage their own users, roles, and project membership. Platform Administration is operated separately and does not participate in day-to-day customer access decisions.
What happens when an employee leaves?
An administrator removes the user from the organization or the relevant projects. Continuous authorization re-evaluates access on the next request, so revoked permissions take effect immediately across the platform.
How are backups handled?
The platform maintains a backup inventory, restore drills, and recovery runbooks as part of its disaster recovery program. Recovery readiness is monitored continuously alongside platform health.
Can organizations manage their own users?
Yes. Organizations invite their own users, assign roles, and manage project membership. Provisioning is invitation-only — no anonymous sign-up path exists.
Evaluating CompleteVue for your organization?
Need architecture details, security documentation, or assistance completing a vendor security review? Our team can walk you through CompleteVue's security model, authorization architecture, and operational controls — or demonstrate the platform in a live environment.
- Version:
- CompleteVue v1.0
- Last Updated:
- July 2026
This page reflects the security architecture currently implemented in the CompleteVue platform.