Privacy & Data Protection

ERYX OS helps general contractors and subcontractors keep compliance records — insurance, licenses, tax forms and related paperwork — in one place. This notice explains what we collect, how it is protected, who else handles it, and how long we keep it.

What we collect

• Account details: the names and work email addresses of the people invited to an account, their role, and records of when they signed in. We never collect passwords.
• Access requests: when a contractor asks for access, the company name, contact name, title, work email, phone number, license details, approximate number of subcontractors and message entered on the form.
• Business records: for subcontractors, the legal business name, license state and number, trades, service areas and business contact details; for contractors, projects, requirements, assignments and payment records.
• Documents: files uploaded to a record, such as certificates of insurance, endorsements, W-9 tax forms, license copies, safety programs, lien waivers and certified payroll, and the policy details read from them.
• Insurance agent contacts: the name, agency, email and phone number of the agents a subcontractor adds so ERYX can request certificates from them. Agents who use an upload link don't need an account.
• Project addresses: job site addresses that contractors enter for their projects.

How it is protected

• Personal details — names, email addresses, phone numbers, insurance agent contacts, project addresses and tax identification numbers — are encrypted (AES-256-GCM) before they are stored.
• Uploaded documents are encrypted at rest and identified by their content, not their file name.
• Each organization's data is isolated at the database level. A contractor sees a subcontractor's records only while the two are connected, and sees a W-9 only if the subcontractor chooses to share it.
• Every create, upload, change and sharing decision is recorded in a tamper-evident audit log.
• Sign-in uses passkeys only. All traffic is served over HTTPS with strict transport security.
• Personal details are never placed in web addresses or written to system logs.

More detail is on our security page.

How it is used

We use this information to run the service: to keep each company's compliance record, check it against the requirements a contractor sets, send invitations, reminders and requests to insurance agents, and produce the reports customers ask for. We do not sell personal data, and we do not use customer documents to train AI models.

Reading certificates with AI

To save typing, certificates of insurance are sent to Anthropic's API, which reads the policy details (insurer, policy numbers, dates and limits). Documents are sent only for that purpose, and under Anthropic's commercial terms they are not used to train its models. What the software reads is saved as a draft: nothing counts until a person at the subcontractor checks and confirms every field.

License and exclusion checks

For California licenses, ERYX checks a subcontractor's license against public data published by the Contractors State License Board (CSLB), which ERYX downloads — nothing is sent to CSLB. To check the federal exclusion list, ERYX sends the subcontractor's legal business name to SAM.gov, run by the U.S. General Services Administration. Each result is kept with the date it was checked.

Who else handles data

• Replit, on Google Cloud — hosting, database and file storage. Encrypted data stays encrypted under our keys.
• Anthropic — reading certificates of insurance, as described above.
• Postmark — sending email. It receives recipient addresses and email text, never financial details.
• SAM.gov — federal exclusion lookups, using business names only.
• GitHub — our source code. It receives no customer data.

How long we keep it

• We keep customer data while the customer's account is active.
• After an account closes, we delete its data within 90 days of a request, unless a law, legal hold or contract requires us to keep it longer.
• The audit log and clearance evidence are kept for up to 7 years, because contractors rely on them in insurance audits and payment disputes. They contain record identifiers, not personal contact details.

Getting a copy of your data

A company's admin can download a complete export of its records at any time from the Security page inside ERYX OS. We can also send an export when an account closes.

Lender applications

Where ERYX OS offers its lending program, an institution applying to become a lender provides organization details (including its tax identification number and addresses), a lending profile, compliance information, contact details for named individuals and supporting documents. That information is protected as described above and used only to evaluate the application and meet the identity-verification and compliance obligations that come with it.

Contact

Questions about your data, or a request to export or delete it: privacy@eryxos.io