Where your drawing goes

1. You upload a drawing

Your PDF travels from your browser over TLS 1.3 and lands in Cloudflare R2 object storage in the United States, encrypted at rest with AES-256. Every object is stored under a prefix scoped to your organization, and every database record that points at it is protected by Postgres row-level security — no other tenant can reach it, and a dedicated cross-tenant leak test runs on every code change to keep it that way.

2. We turn pages into images

An automated extraction job splits the PDF and renders each drawing page as an image. Only those page images move to the next step — not the original file, and not the PDF's embedded metadata. The original PDF never leaves your tenant's storage.

3. Page images go to Anthropic for extraction

The page images are sent over TLS to Anthropic's API in the United States, where an AI model reads them and returns a structured bill of materials. Anthropic processes them under their standard commercial API terms: your drawings are not used to train models, and Anthropic may retain API inputs only for the limited period their commercial terms allow for trust-and-safety monitoring. Anthropic is a disclosed subprocessor with 30 days notice before any change to the list.

4. Results are stored in your tenant

The extracted line items are written to our Postgres database (Neon, United States) under your organization, behind the same row-level security as everything else. The drawing itself stays in your tenant's object storage; nothing derived from it is shared with any other customer.

5. You review and export

Your estimators review the extracted BOM in the app before anything ships to a bid, and can export it as xlsx or csv at any time. Every state-changing action along the way lands in an append-only, hash-chained audit log your admins can export and verify.

6. Deletion removes everything

When you delete your organization, database rows are removed by cascading deletes and a purge job deletes every object under your organization's storage prefix — drawings, exports, imports, and archives. Residual object versions held for recovery expire under a 90-day lifecycle policy. The full schedule by data class is published in the data processing agreement.

What we never do

• Sell, resell, or share your drawings or extracted data with third parties beyond the disclosed subprocessors that operate the service.
• Train models on your drawings or extracted data, or permit a subprocessor to.
• Move your data outside the United States, or to a subprocessor not on the public list.

What not to upload

PipeTakeoff.com is not authorized to process export-controlled technical data (ITAR or EAR), classified information, or controlled unclassified information (CUI). If a project carries those restrictions — or your upstream contract prohibits disclosure to our listed subprocessors — do not upload its drawings. The acceptable use policy makes this a condition of use.

Want to go deeper?

The security overview covers encryption, tenant isolation, audit trails, and incident response. The subprocessor disclosure lists every vendor, the data it processes, and its region. Questions from a security review: security@pipetakeoff.com.