Security & Data Protection

Built like a vault.
Run like a job site.

The Goliath dashboard was engineered with the same layered security practices used by enterprise software - passwordless access, encrypted connections, forensic e-signatures, a full compliance trail, and automatic offsite backups. Here is exactly how your company and client data is protected, and how that compares to how most builders operate.

0passwords stored - nothing to steal or phish
7independent layers of defense
3separate copies of every business record
14days of restore points, rotated automatically
100%of traffic encrypted, enforced sitewide

Seven layers of defense

Security isn't one lock - it's a series of doors. An attacker would have to defeat every one of these layers, in order, to reach anything of value.

1
Encrypted front door Every connection is forced onto HTTPS with strict transport security - nothing travels the internet in plain text, ever.
2
Passwordless identity There are no passwords to leak, reuse, or phish. Sign-in is a one-time 6-digit code sent to a named employee's company email, valid minutes, used once.
3
Named-employee allowlist Only specific, pre-approved company email addresses can even request a code. A stranger with the web address gets nothing.
4
Expiring sessions Signed-in sessions expire after 24 hours of inactivity - a lost or stolen device locks itself out automatically.
5
Vaulted secrets & data API keys, credentials, and every business record live in a private area of the server the web cannot reach - not in the website code, not in the browser.
6
Locked company mail All system email sends through Microsoft 365 with SPF/DKIM authentication, and the sending permission is locked to one single mailbox - even if the app key leaked, it couldn't send as anyone else.
7
Complete audit trail Every sign-in and every submission is logged - who, what, when, and from where - in a hidden server-side compliance record that can't be edited from the website.

Your data exists in three places

Every day, the system automatically packages every record - projects, change orders, signatures, compliance logs - and stores it in three independent locations. Losing any one of them, including the entire hosting company, loses nothing.

1 · Live data The working records the team uses every day, stored above the web root where browsers can't reach.
→
2 · Server vault A dated backup archive is created daily and kept for 14 days - a two-week rewind button for the whole business.
→
3 · Offsite copy The same archive is emailed to the office through Microsoft 365 - a copy that lives completely outside the hosting company.

Court-ready client signatures

When a client signs a change order, the system doesn't just record a squiggle. Each signature is sealed with the same categories of evidence used by DocuSign-class services:

✓ Explicit consent checkbox ✓ Typed legal name ✓ Hand-drawn signature ✓ Date & time stamp ✓ Signer's network address ✓ Device fingerprint ✓ Document fingerprint - proves the terms never changed after signing ✓ Private one-time signing link per client

How this compares

The same protections, side by side with how a typical builder's office runs and what big-name enterprise software provides.

Protection Typical builder office Enterprise software Goliath Dashboard
Password risk ✗ Shared passwords, sticky notes ◐ Passwords + 2FA ✓ No passwords exist at all
Who can get in ✗ Anyone with the password ✓ Managed accounts ✓ Named-employee allowlist only
Encrypted connection ◐ Sometimes ✓ Yes ✓ Enforced on every page
Client sign-offs ✗ "Sounds good" by text or email ✓ E-sign service (per-envelope fees) ✓ Built-in forensic e-sign, no per-signature cost
Daily backups ✗ Rarely - one copy on a laptop ✓ Yes ✓ Automatic, 3 locations, 14-day history
Offsite copy ✗ No ✓ Yes ✓ Daily, independent of the host
Compliance audit trail ✗ None ◐ Premium tiers ✓ Every sign-in & submission, standard
Email spoof protection ✗ Free email accounts ✓ Authenticated sending ✓ Microsoft 365, locked to one mailbox
Outage detection ✗ A client tells you ✓ 24/7 monitoring ◐ 24/7 independent monitoring - being enabled now
The bottom line: most builders run their business on shared passwords, unencrypted email approvals, and a single copy of their records. The Goliath dashboard runs on enterprise-grade practices - passwordless access, sealed signatures, a full audit trail, and data that exists in three places at once - without enterprise-software subscription fees. Security isn't a feature we added; it's the foundation everything else is built on.