Submittal software security, how your project documents are handled
Your project manual, shop drawings and review history are contract records, and some of them describe buildings in detail. This page explains how Submittal stores them, who can see them, what happens when spec text is read by AI, and how you take everything out or delete it. It describes what the product does today, in plain language, without badges or claims we cannot back.
Encryption in transit and at rest
Every connection to Submittal uses HTTPS with current TLS, including file uploads, downloads, exports and email links. Stored data, meaning the database and every uploaded file (spec PDFs, product data, shop drawings, sample photos, stamped returns), is encrypted at rest. Files are served only through signed links that expire, so a forwarded download link stops working after a short time.
The service runs with a hosting provider in the US. Backups are encrypted the same way as the live data.
Roles and permissions on every project
Access is set per project and per company, not per file you have to remember to share.
- Admin manages the account, plans, members and project settings.
- Project engineer builds the register, creates packages, routes reviews and sets dates.
- Subcontractor sees and uploads only the packages assigned to its company.
- Reviewer sees the packages routed to it and returns stamps and comments.
- Viewer reads status and approved documents without changing anything.
Internal members count toward your plan (5 on Starter, 25 on Team, unlimited on Business and Enterprise). Removing a member ends their access immediately, while their past actions stay in the history.
External reviewer and subcontractor access
Architects, consultants and subcontractors join a paid project at no cost on every plan. They sign in with their own email and a code, see only what has been routed or assigned to their company on that project, and never see your other projects, your team list or your billing. On the Team plan and above, subcontractor portal links give a sub access to its own packages without browsing the rest of the log.
SSO and audit log on Business and Enterprise
On the Business and Enterprise plans, your team signs in through your identity provider with SAML single sign-on, so access follows your own onboarding and offboarding. The audit log records who viewed, uploaded, routed, stamped, exported or deleted what, and when, and can be exported for your records. Enterprise adds data residency in the US for stored project data.
How AI reads your spec
To build the register, Submittal extracts the text of the project manual and sends to AI only the text needed to find submittal requirements: section numbers, titles and the submittal articles. Drawings, product data and other attachments are not sent. The spec text is processed to return register rows and is not used to train models. Every row links back to its paragraph, so a person confirms the result before it becomes part of the log.
Retention, archive and export any time
- Archived projects stay readable and exportable and do not count as active.
- You export the full submittal log to Excel, CSV and PDF at any time, on every plan, with transmittals as PDF.
- Closeout binders (Business and Enterprise) export as one PDF with a table of contents.
- Version history keeps every revision, stamp and comment; nothing is overwritten.
- Enterprise sets custom retention to match your company's records policy.
Cancel any time and keep access to the end of the paid period, enough to export what you need.
Deletion on request
Account owners can delete a project from its settings. To delete the whole account and its data, write to [email protected] from the account owner's address. Deletion covers the database records and stored files, and backups roll off on their normal cycle. We confirm by email when it is done. More on how data is handled is in the privacy policy.
What you control
Security is shared. You decide who joins each project, which companies see which packages and when members leave. Use SSO on Business and Enterprise, review the audit log when a project closes, and archive finished jobs instead of leaving them active. If you see anything that looks wrong, write to [email protected].
Compare plans on submittal management software, see what the product does on submittal software, or read how the construction submittal process runs inside it.
Frequently asked questions
Is my spec used to train AI models?
No. Only the text needed to find submittal requirements is sent to AI, it is processed to return register rows, and it is not used to train models.
Can subcontractors see other subcontractors' packages?
No. A subcontractor sees only the packages assigned to its own company on that project.
Where is my data stored?
With a hosting provider in the US. Enterprise adds data residency in the US as a contractual commitment for stored project data.
Does Submittal hold a security certification?
We describe the controls the product has, encryption in transit and at rest, roles, SSO and audit log on Business and Enterprise, rather than certifications. If your review needs more detail, write to [email protected].
How do I get all my data out?
Export the log to Excel, CSV and PDF from any project at any time. Approved documents, transmittals and closeout binders download as PDF.