Procurement pack
The security questionnaire answered once — every control with its honest state, on one page you can print or save as PDF.
EstiLumina
Negi Enterprise Inc · British Columbia, Canada · support@estilumina.com
Procurement pack · version 1.0
October 27, 2026
October 27, 2026
11 controls in place, 2 partial, 3 not offered. A state is never rounded up; every line says where to read it for yourself.
Controls
| Control | State | What exists | Read it |
|---|---|---|---|
| Workspace isolation | In place | Every workspace’s records are fenced in the database itself: the workspace comes from the signed-in session, never from the browser, and a person in two workspaces holds a separate role in each. | Trust Center |
| Sign-in | In place | Email and password, a sign-in link, or Google and Microsoft where turned on; an authenticator-app second step for any person who turns it on, which a workspace’s admins can require of everyone; leaked passwords refused; each person sees where their account is signed in and ends any session, and is emailed when it signs in from a browser and system it had not used. | Security help |
| Company single sign-on (SAML) | Not offered | Not offered at this price. Sign-in is per person, with the second step available to everyone and required where a workspace asks for it. | Security help |
| Roles and permissions | In place | Eight roles with defaults, overrides per person, access per project; the same rules are enforced by the database, not only by the screens. The matrix is printed below. | Team and permissions help |
| Audit trail | In place | Money, owner-portal, award and signature events are written to the workspace’s audit log and export as CSV from Settings. | Trust Center |
| Encryption | In place | TLS on every connection; encryption at rest by the hosting providers; integration tokens encrypted with a key only the server holds; no secret is ever kept in the code. | Trust Center |
| Change management | In place | Every change passes the same gate before it ships — a secrets scan, the unit suites, the type check, both builds, the accessibility and page-weight budgets, the browser walks — and every database change is a numbered, reviewed migration applied by hand. | What’s new |
| Availability and monitoring | In place | A public status page with ninety days of history from a check every fifteen minutes; runtime errors monitored without personal data in the reports. | System status |
| Backups and recovery | Partial | Daily database backups by the hosting provider, and every workspace exports its own data at any time. Point-in-time recovery is a setting not yet turned on. | Trust Center |
| Content Security Policy | Partial | The policy reports on every page today; it is enforced once its reports read clean. | Trust Center |
| Incident response and disclosure | In place | A written runbook with severities and the customer notice; researchers reach us through the published security contact. | security.txt |
| Vendors | In place | Every subprocessor is published with its purpose and region (listed below); the data and the application are hosted on Supabase and Vercel only. | Subprocessors |
| Privacy and legal | In place | Terms, Privacy and the AUP carry versions, and each person’s acceptance is recorded with the versions, the way and the time; the DPA is dated, and a signed copy is available on request. | DPA · Privacy |
| Abuse and rate protection | In place | Rate limits on sign-in and the API; payment and e-sign callbacks refuse an unsigned request; scheduled jobs need a shared secret. | Trust Center |
| Penetration test | Not offered | Not yet run by an outside firm; planned before an attestation is engaged. | Trust Center |
| SOC 2 | Not offered | Control map published; attestation not yet engaged. | Trust Center |
Facts asked beside the controls
- Operator: Negi Enterprise Inc, British Columbia, Canada
- Where the data lives: The database in the United States (Supabase); the application on a global edge (Vercel) (Subprocessors)
- Retention: A workspace’s records stay while it is open and export at any time; a deleted record waits thirty days in the recycle bin before it is gone (Privacy)
- Security contact: support@estilumina.com — published for researchers in security.txt (security.txt)
- Status history: Ninety days, from a check every fifteen minutes (System status)
Subprocessors
| Vendor | Purpose | Region | When |
|---|---|---|---|
| Supabase | Database, Auth, Storage | United States | Always |
| Vercel | Application hosting / CDN / web analytics and performance telemetry | Global edge | Always |
| Stripe | Subscriptions and Client Collect | Global | Always |
| Resend | Transactional email (invites, notices) | United States | Always |
| Upstash | API rate protection | United States | Always |
| Sentry | Error monitoring | United States | Always |
| DocuSign | Envelope e-sign | United States | When you turn it on |
| Intuit QuickBooks Online | One-way invoice and customer push | United States | When you turn it on |
Support response times
| Severity | What it looks like | First response |
|---|---|---|
| P0 | Outage, data problem, or payments blocked | 4 business hours |
| P1 | A major feature is broken | 1 business day |
| P2 | A workaround exists | 2 business days |
Business hours are Monday to Friday, Pacific time. First response means a person has looked at it and said what happens next.
The roles model
| Permission | Admin | Project Manager | Coordinator | Estimator | Accounting | Site Superintendent | Field | Viewer |
|---|---|---|---|---|---|---|---|---|
| Can manage team | ✓ | — | — | — | — | — | — | — |
| Can delete projects | ✓ | — | — | — | — | — | — | — |
| Can delete invoices | ✓ | ✓ | — | — | — | — | — | — |
| Can create change orders | ✓ | ✓ | ✓ | ✓ | — | ✓ | — | — |
| Can export reports | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | — | — |
| Can view all projects | ✓ | ✓ | ✓ | ✓ | ✓ | — | — | — |
| Can manage financials | ✓ | ✓ | — | — | ✓ | — | — | — |
| Can view financials | ✓ | ✓ | ✓ | ✓ | ✓ | — | — | — |
| Can edit takeoff | ✓ | ✓ | — | ✓ | — | — | — | — |
The defaults of each role; an admin overrides any of them per person and limits a person to the jobs they are on. Owners and trades on signed links never take a seat.
The legal pack
Terms · Privacy · DPA · AUP · Subprocessors · security.txt · System status