Skip to content

Trust Center

HOW WE KEEP YOUR
DOCUMENTS PRIVATE.

Your tender drawings, your owner's emails, your fee schedules — none of it should ever be on a third party's training set or leaked to a competing GC. The whole point of a Marapone build is that the model and the data live where you put them. Here's exactly how that works.

Download the Security Pack (PDF) See the Architecture

Everything in one place

Security & Trust Pack →

Data-flow diagram, deployment models, and data-handling defaults in one printable PDF for your IT team.

Architecture →

How the system is built and where each component runs.

Integrations →

What it connects to — and what stays inside your walls.

Security & disclosure →

Security overview and vulnerability disclosure contact.

Data residency

WHERE THE DATA LIVES

Marapone is based in Toronto and Rome. We do the build work from those offices. The system itself runs wherever you want it: on your laptop, on a server in your office, or in your cloud tenant.

CANADA

Toronto residency

Default for GCs anywhere in Canada or the US. PIPEDA-aligned defaults.

EU

Rome / EU residency

Default for European clients. GDPR-resident processing.

ENTERPRISE

Your own cloud tenant

Deployment into your AWS or Azure tenant, under your keys and your retention policy. Enterprise tier only, quoted as a project.

Designed so these cannot happen

FOUR THINGS THE ARCHITECTURE RULES OUT.

Take none of this on trust. Each one below is a property of how the system is built, not a policy we promise to follow — which means each one has a check you can run yourself, on your own documents, inside the fourteen-day window before the money is committed.

One thing to be clear about before you read them: Marapone is a hosted service. Your documents are uploaded to infrastructure we operate, in the browser and in the MaraponeAI mobile app alike, and there is no configuration that keeps processing on your own machines. Everything below is about what happens to those documents once they are with us — not a claim that they never left.

RULED OUT 01

Third-party LLM API calls

The system is built with no client for OpenAI, Anthropic, Google, or any hosted model provider. Inference runs on our own open-weights model, on infrastructure we operate, so there is no code path that could send a drawing or an RFI to one of them.

Check it yourself

We will show your team the architecture diagram and name the exact service that handles inference, under NDA, before you commit to anything.

RULED OUT 02

Model training on your data

Uploads are processed to serve you and never used to train a model — including ours. There is no fine-tuning step that touches a customer's documents, on our infrastructure or anyone else's.

Check it yourself

We will walk your team through how the model was built and on what, under NDA, before you commit to anything.

RULED OUT 03

One pooled pile of everybody's projects

Your documents are read in a workspace scoped to your account. No other subscriber's account reaches it, no project of yours is visible from another firm's session, and nothing is merged into a shared corpus. On Firm, each project gets its own workspace again inside your account.

Check it yourself

Ask the programs about a project you have not uploaded to that workspace, in any wording you like. There is nothing there to find.

RULED OUT 04

Cross-client data sharing

Nothing you upload is used to train a model — not ours, and there is no third-party AI vendor in the path to train anyone else's. The model does not learn from your tender package, so nothing from one GC's work has a route into another's answer.

Check it yourself

Ask any client we refer you to whether their build has ever received an update they did not install themselves.

Certifications, honestly

WHAT WE HOLD — AND WHAT WE DON'T.

If your procurement team asks for certifications, here is the straight answer before you spend a call on it.

Not held today

  • ×SOC 2 Type I or II. Not started. It audits the controls of a service organisation running your data. It is the right instrument for what we now are — a service organisation running your data — and it is not in place yet. That is a gap, and we are not going to describe it as anything else.
  • ×ISO 27001. Not held.
  • ×Independent penetration test of the mobile service. Not yet commissioned. The service is not in the stores yet; a test before general release is on the plan and we will publish the date it happens rather than the fact that it is intended.

We will pursue a third-party architecture review, a penetration test of the mobile service before it leaves beta, and SOC 2 Type I if enterprise volume justifies the cost. We would rather say that plainly than imply a certification we do not have. If your procurement process requires SOC 2 for anything you upload to a vendor, we do not currently clear that bar, and you should know it before the call rather than after.

What you get instead

  • ✓A written answer to every question on this page. Where your files sit, who can reach them, how long they are kept — in writing, for your IT review, before you pay anything.
  • ✓A pilot on one live job. Cancel any time, run against a tender you can check line by line.
  • ✓A written security pack with the data-flow diagram, deployment models and handling defaults, for your IT review.
  • ✓A reference call with an existing client running comparable work.

Reference call

Talk to someone who already runs one.

The strongest evidence we can offer is not a certificate, it is a client on a call with you, unaccompanied, answering whatever you want to ask. Tell us the size and shape of your shop and we will introduce you to the closest match who has agreed to take these calls. We do not sit in on them.

Request a Reference Call →

Compliance posture

THE PAPERWORK SIDE

NDAs standard

Mutual NDA on the first call if you'd like one. Project-specific NDAs available before any build starts.

Audit trail

Every model query, every document touched, every response is logged with a timestamp and the user. Searchable. Exportable.

Retention policy

You set the retention windows per document class — RFIs 7 years, daily logs 10, owner emails by your own policy. We don't.

Deletion on demand

A single command (or UI button) wipes a project's documents, embeddings, and any project-specific fine-tuned weights from the system.

Construction-specific

DRAWING IP & PROJECT SEGREGATION

Drawing confidentiality

Tender drawings are sensitive, and owners and architects often have explicit clauses against sharing them with a third-party service. Read yours before you subscribe: Marapone is a third-party service, your drawings are uploaded to us, and no wording on this page changes that. What we can tell you is that they go no further — no sub-processor sees them, no AI vendor is in the path, and nothing trains on them. If the clause is absolute, do not buy a plan; ask us about deployment into your own cloud tenant instead.

NDA template available

We can provide a Marapone-side NDA template that explicitly covers tender drawings, project schedules, owner correspondence, and trade pricing. Ask for it during the discovery call.

Per-project segregation

Each project gets its own namespace in the vector store. A user with access to Project A cannot retrieve content from Project B unless explicitly granted. This is a default, not a paid tier.

The exception on this page

THE MOBILE APP IS HOSTED.
HERE IS WHAT THAT COSTS YOU.

Everything above describes software that runs where you put it. The MaraponeAI mobile app, shipping Q4 2026, is the one product where that is not true: a phone cannot hold a 48,000-line engine and a model, so the five engines run on infrastructure we operate and the phone is the screen. A document you audit in the app is uploaded to be audited. There is no version of this page where that sentence is softer, so it is the first one.

What you give up

  • ×The air gap. Documents leave your premises — that is what a hosted program is. If an owner or architect contractually bars putting tender drawings on a third-party service, no plan satisfies that clause, and an enterprise deployment into your own tenant is the only version of this we can offer.
  • ×Offline operation. Lists you have already opened stay readable and are stamped with when they were fetched. New work needs a connection.
  • ×Independence from us. If Marapone disappears, the programs stop. There is no copy on your disk that keeps running. What survives is everything you exported — which is why export is on demand, unlimited, and in formats that need none of our software to open.

What holds anyway

  • ✓No third-party AI vendor. The assistant is our own open-weights model on the same infrastructure as the engines. Your tender documents never reach OpenAI, Anthropic or Google.
  • ✓No training on your work. Uploads are processed and stored to serve you, never used to train a model — including ours.
  • ✓One isolated workspace per account. The assistant is only ever handed your workspace, so no query can reach another GC's estimate.
  • ✓Residency and exit. Canada by default, EU on request. Export to PDF, Excel or CSV whenever you like; 90 days of retention after a lapse, then deletion; self-serve deletion from your account settings is instant — no ticket, no waiting period.

No plan changes the data path.

Field, Pro and Firm differ in seats, programs and priority — not in where your documents are read. Paying more does not make the processing local, and paying less does not make it less private. The reading happens on our infrastructure on every plan, governed by everything in this section.

How the app works Privacy Policy §06 — app data Terms §13 — the hosted service

Deployment security defaults

WHAT'S ON BY DEFAULT, PER DEPLOYMENT

There are two arrangements, not four. Every plan is the hosted one. The second exists only at the enterprise tier, for firms whose contracts will not allow the first — and it is a project, priced as a project, not a checkbox on the pricing page.

Plan — hosted by us Enterprise — your own cloud tenant
Where documents sit Our infrastructure (CA or EU) Your tenant, your region
Encryption at rest Managed keys, our infra AWS KMS / Azure Disk, your keys
Network exposure Public API over TLS Private VPC
Access control Account login, per-account workspace SSO + IAM + role
Third-party AI vendors None — our own model None — our own model
Training on your work Never Never
Retention Yours to set; export or delete on demand Your own policy, applied in your tenant
Air gap Not available Not available — the tenant is yours, but it is still a network service

We used to sell a laptop install and an on-prem server, and both columns are gone from this table because both are gone from the business. If a truly disconnected install is a hard requirement on your project, we are not the vendor for that job and would rather say so here.

Your side of the line

CUSTOMER RESPONSIBILITY CHECKLIST

We secure the service. The following stay on your side:

Read the legal docs

Privacy Policy

How we handle data on the marketing site and during engagements.

Terms of Service

Default engagement terms; bespoke MSAs available.

Security

Detailed security overview, vulnerability disclosure, and contact.

Need a security review pack?

SEND IT TO YOUR IT TEAM
BEFORE WE START.

We have a one-page security overview, a data-flow diagram, and a draft NDA ready to send. No fluff, no marketing — your CISO will thank you.

Open the Security Pack → Request a Draft NDA