Enterprise
Security and trust
This page answers what IT and procurement ask before they email us: where project data lives, what our servers hold, which vendors process it, how long we keep it, and how to get a DPA, an invoice, or a completed security questionnaire. Last reviewed October 28, 2026.
Data residency
Where your data lives
On your devices
Punch lists, items, photos, signatures and PDF reports are stored on the phone or tablet that created them. Punch List does not upload project content to our servers. It leaves the device only when someone exports it: a PDF report, or a .pnch file handed to another team member.
On our servers (United States)
We hold the records needed to run licenses and billing, nothing from inside your projects. Our database and service providers are hosted in the United States.
What we store
- Account: the email address used to sign in, a name if one was given, and the sign-in method (email code, Google, or Apple). No passwords; we never store one.
- License: your organization name, seat count, license status and renewal date, and the work email address of each person you add as a member or admin.
- Activation: an app-generated device identifier for each phone or tablet that activates a seat or an MDM license key, with the date it last checked in.
- Billing: your Stripe customer ID, plan, billing cycle, and the last four digits of the card. Full card numbers never touch our systems; Stripe holds them.
- Server logs: IP address, user agent, route, status code and timestamp, kept for 30 days by our hosting provider.
- Support email: your correspondence with us, kept for two years after the issue is resolved.
Vendors
Subprocessors
Five companies process the records above on our behalf, each under a written data processing agreement. Compliance posture below is as stated on each vendor's own security page on October 28, 2026; their reports are available through their trust centers, most on request.
| Vendor | What it does for Punch List | Data it processes | Compliance posture |
|---|---|---|---|
| Vercel | Website and API hosting | Server logs (30 days); requests pass through its functions | SOC 2 Type II, ISO 27001:2022; encrypted at rest (AES-256) and in transit |
| Neon | Database of record (PostgreSQL) | Account, license, activation and billing records | SOC 2 Type II, ISO 27001:2022; AES-256 at rest, TLS 1.2 or higher in transit |
| Clerk | Sign-in and sessions | Email, name, sign-in method, session tokens | SOC 2 Type II; hosted on Google Cloud and Cloudflare in the US |
| Stripe | Payments, invoices, Customer Portal | Billing details and card data (card numbers stay inside Stripe) | PCI DSS Service Provider Level 1, SOC 1 and SOC 2 Type II |
| Resend | Transactional email (welcome, invites, receipts) | Email address and message content | SOC 2 Type II; data stored in the US, AES-256 at rest, TLS in transit |
Analytics and advertising-measurement vendors used by the apps and this website (Google Firebase, Google Analytics, Meta) are listed in our Privacy Policy. Devices managed through an MDM send no advertising-measurement events, and project content is never part of analytics.
Protection
Encryption and access
- All traffic between the apps, the website and our servers uses TLS 1.2 or higher.
- Stored records are encrypted at rest by the providers above.
- Sign-in is a 6-digit code emailed to the work address you added, or Google or Apple sign-in. There are no passwords to leak or rotate.
- Internal access to production follows least privilege. Rojao Inc is a small company; the people with production access can be counted on one hand and are named in the DPA on request.
- Enterprise license keys (for MDM-activated shared devices) are stored hashed. We cannot read a key back; if one is lost we revoke it and issue a new one.
- Removing a person on your account page frees their seat immediately. Their Pro access ends the next time the app checks in, within 24 hours.
Network
Offline operation and network requirements
Punch List works fully offline once a seat or license key is active. The app checks its license once a day when it has a connection and keeps Pro active for up to 14 days without one. Devices need outbound HTTPS to two hosts only:
www.mypunchlistapp.com(license activation and refresh)clerk.mypunchlistapp.com(email sign-in)
Fully air-gapped fleets are not supported today; a device must reach those hosts at least once every 14 days. See the MDM deployment guides.
Retention
Retention and deletion
| Category | Retention |
|---|---|
| Account data (Clerk) | While the account is active; deleted within 30 days of a verified request |
| License and subscription records | As required by tax and accounting law, typically up to 7 years |
| Server logs | 30 days |
| Support correspondence | 2 years after resolution |
| Backups | Up to 35 days before deleted data is overwritten; backups are encrypted and not used by any live system |
To delete an account, email privacy@mypunchlistapp.com from the address on file with the subject "Delete my account". We process it within 30 days and confirm by email. Project content on devices is deleted when the app is removed from the device; we never had a copy.
Compliance
Compliance documents
What we can send today, and what we are honest about not having.
- Data Processing Addendum: a standard DPA covering GDPR, UK GDPR and CCPA, on request.
- Subprocessor list with transfer safeguards: for data originating in the EEA, UK or Switzerland, transfers rely on the EU-US Data Privacy Framework where the vendor is certified and on Standard Contractual Clauses otherwise. On request.
- Security questionnaires: send yours (SIG Lite, CAIQ, your own template) and we return it within 1 to 2 business days.
- Our own audit reports: Rojao Inc does not hold a SOC 2 or ISO 27001 report of its own. Our vendors above do, and because project content never reaches our servers the records we hold are limited to the account, license and billing fields listed on this page.
- Breach notification: we notify affected customers and regulators as required by law, and we will tell your named technical contact directly.
Buying
Procurement
- Invoice or purchase order billing at any seat count. Email us for a quote and PO instructions; we accept ACH, wire transfer, or check, and card through Stripe.
- Self-serve checkout by card covers 5 to 500 seats and issues a Stripe invoice you can download from your account page.
- W-9 and vendor registration forms on request.
- Support: email, 1 to 2 business days. For an issue affecting an active field deployment, put URGENT in the subject line for same-day attention during business hours.
- One contact for all of it: enterprise@mypunchlistapp.com
Security FAQ
Common questions
- Does Punch List store our project data in the cloud?
- No. Punch lists, items, photos and reports stay on the device that created them. Our servers hold only account, license, activation and billing records. Project content leaves a device only when a user exports a PDF or a .pnch file.
- Where are your servers?
- In the United States. Our database (Neon), authentication (Clerk), email (Resend) and payments (Stripe) providers host the records in the US; the website and API run on Vercel.
- Do you have a SOC 2 report?
- Not our own. Rojao Inc, the company behind Punch List, does not hold a SOC 2 or ISO 27001 report. Each of our five subprocessors does hold SOC 2 Type II, and the records we hold are limited to account, license and billing fields. We complete security questionnaires within 1 to 2 business days.
- Can we get a DPA?
- Yes. We provide a standard data processing addendum covering GDPR, UK GDPR and CCPA. Email enterprise@mypunchlistapp.com to request the current version.
- What happens to our data if we cancel?
- Seats stop renewing and Pro access ends at the end of the paid term. Member email addresses and license records are kept as required by tax and accounting law, then deleted. Project content was never on our servers, so there is nothing of yours to return or destroy on our side; it stays on your devices.
- Can devices work without internet access?
- Yes, for day-to-day use. After activation the app works fully offline and keeps Pro active for up to 14 days without a connection. It needs to reach www.mypunchlistapp.com and clerk.mypunchlistapp.com at least once every 14 days, so fully air-gapped fleets are not supported.