Security
LiveArch's layered security model, plus recommendations for managing project access.
Security architecture
For IT & security reviewers
LiveArch is built on a defense-in-depth model: access control, administration, third-party integrations, monitoring, vulnerability management, and infrastructure are each treated as an independent layer. No single control is relied on alone, so a gap in one layer does not by itself expose project data.
Access control
Project access is granted per project — and all access is time-limited, generally expiring shortly after the project is completed.
Administrative oversight
Application administration runs through a dedicated admin portal with a defined set of permitted overrides. Access is restricted to a small internal support team, and administrative actions are recorded in an audit log.
Monitoring & support
Production systems are continuously monitored for errors and failures, and the platform is actively maintained and supported by BBB's Design and Construction Technology team.
Procore integration boundary
Procore independently enforces its own permission model for integration, and LiveArch requests minimal access; only data that its RFI and Submittal workflows need — never scheduling, financial, or workforce data.
Vulnerability management
Code is reviewed with security in mind, dependencies are monitored for known vulnerabilities, and credentials are rotated regularly and stored in encrypted form.
Infrastructure
Access to production infrastructure is tightly restricted and protected by multi-factor authentication. All systems are kept current through regular audits and updates.
Security & Access Recommendations
- Project access is granted per project — being listed in a company directory does not grant access to every project.
- when someone leaves the project or their organization, so their account can be disabled.
- Share files with outside recipients through scoped, expiring share links rather than granting full project access.
- Report suspected unauthorized access or other security concerns through a and to the project manager.
Support
Questions or issues? We're happy to help — , or use the contact form if you're signed out.