Your catalog, pricing and customers stay yours.

For manufacturers, distributors and the IT and security teams who review software for them. In plain terms: what happens to the data you load, who can see it, where it runs, and how we protect it.

Last updated October 2026. Where this page and your agreement differ, your agreement governs.

What you're trusting us with, and how we treat it

Your catalog, your pricing and your customer relationships are the business. Here's what we commit to, in the order buyers usually ask.

Confidential

Your pricing and margins stay confidential

Catalog, pricing and configuration data are handled as confidential or restricted business information. They're used to run your service and for nothing else.

Isolated

Competitors on the platform can't see you

Each customer's environment is isolated. We never combine customers' data in a way that could expose one customer's information to another.

Yours

Your customers stay your customers

A distributor owns its own customer and configuration records. In a manufacturer-sponsored program, the manufacturer never sees a distributor's individual customers.

Not for training

Your data doesn't train anyone's AI

We don't use your data to train AI models or fine-tune them, and we don't share it with third parties for marketing, analytics or training.

Hands off

We don't need into your ERP

No connection to your systems by default. A proof of concept can run on exported files. Any integration is scoped and approved by you first, and can be revoked at any time.

Deleted

Files aren't kept longer than needed

Source files are deleted after processing unless your scope needs them. Trial data never becomes production data unless you approve it, and deletion requests are handled under your Data Processing Agreement.

Who can see what

Distributors are protective of their customers, and manufacturers want demand insight. Access is designed so both can be true at once.

WhoWhat they can seeWhat they can't
Your organizationWithin the roles your admins assignYour catalogs, configurations, quotes and customer recordsAny other customer's data
Other customersIncluding competing distributorsNothing of yoursYour pricing, catalogs, quotes or customers
A sponsoring manufacturerOnly where your agreement provides for itAggregated, non-personal analytics: which products and assemblies are configured, activity and trendsYour individual customers, or records that identify a distributor's customers
Intelli.Build personnelAuthorized, named, role-basedOnly what operating and supporting the service requiresAnything outside their role. Access is approved, uses MFA, is reviewed and is logged

Where the platform runs

Intelli.Build is hosted on Amazon Web Services and fully managed by us. Your production data stays inside that AWS environment. We keep no on-premises copy and use no other hosting provider for it. When AI features are used, the relevant inputs go to the model providers named in your agreement.

1 · Your teamWeb browser

Signs in with a named account

2 · The only way inPublic entry layer

Managed load balancing. Encrypted connections end here.

3 · Private networkApplication and data

Platform services, PostgreSQL and file storage. Not reachable from the internet.

4 · Second regionDisaster recovery

Continuous copies of the database and selected file storage.

Applied at every layer

  • Traffic restricted by source, protocol and port
  • Encryption and key management with AWS services
  • Central logging and monitoring
  • Role-based access, with MFA for administrators
  • Outbound traffic limited to documented destinations
  • Production, staging, development and trial environments kept separate
Your systems Not connected

Nothing links to your ERP, network or email unless you request it and approve it. Trial work can use exported files.

The life of your data

Data is processed only for the purpose you agreed: catalog preparation, configuration rules, quoting, validation, reporting or integration. Any new purpose is added to your agreement before processing starts.

  1. You send itThrough an agreed transfer path or a dataset you provide
  2. It's received securelyInside the controlled platform environment
  3. It's processedPages, tables and structured data are read, checked and organized
  4. Outputs are builtYour catalog, rules, pricing or configuration outputs
  5. Temporary files are deletedSource, drawing and geometry files, unless your scope needs them
  6. Only approved records stayYour approved catalog, configuration model, quotes and integrations

What the platform may hold

  • Product catalog, materials and component data
  • Configuration rules and pricing
  • Generated quotes and configuration outputs
  • Files you send for a trial or proof of concept
  • User accounts: names, work emails and roles
  • Operational records such as logs, audit trails and metrics

How it's treated

  • Business data is confidential or restricted information
  • Personal data is handled under your Data Processing Agreement
  • The platform doesn't need sensitive personal data, so please leave it out of the files you send
  • Logs may reference records by ID but are never used to rebuild your data
  • After a deletion, logs may briefly record that it happened, never what was deleted

The AI works for your team, within your rules

The assistants answer from your data and act only within the access the person using them already has.

  • Never trained on your data. We don't train or fine-tune models on customer data. The commercial API terms of the model providers we use state that inputs aren't used for training.
  • Grounded in your sources. Answers come from your catalogs and documents, part numbers and values are checked against your catalog, and each answer cites its source page.
  • Same permissions as the person asking. An assistant can't see or do anything the signed-in user couldn't.
  • A person approves what goes out. Drafted emails and quotes wait for approval. Nothing goes to a customer or supplier on its own.
  • Credentials never reach the model. Integration keys and passwords stay out of AI prompts.

Technical controls, in detail

For engineers and security reviewers. A fuller technical description is available under NDA.

Network

  • AWS VPC with public and private subnets
  • Security groups by source, protocol and port
  • Backend services and databases not directly reachable from the internet
  • Admin access only through approved network paths
  • Outbound destinations documented and limited
  • Rules reviewed against the design on a schedule

Identity and access

  • Named accounts and role-based permissions
  • Customer users, customer admins, platform admins, engineers and operations are separate roles
  • Single identity provider for staff, with MFA on admin systems
  • Scoped, rotated, revocable service credentials
  • Privileged access reviewed by people who don't hold it
  • Controlled onboarding, role changes and offboarding

Encryption

  • TLS for all external traffic, outdated protocols disabled
  • Certificates monitored for validity and rotation
  • Encryption at rest for every store holding customer data
  • AWS key management for storage, databases and backups
  • Secrets in secret management, never in source code
  • Customer-managed keys available through your agreement

Logging and monitoring

  • Infrastructure, application, deployment and admin activity logged centrally
  • Alerts routed by severity
  • Log archives protected from tampering
  • Write-once retention where required
  • Access to logs restricted and itself logged
  • The monitoring is monitored too

Engineering and change

  • Private repositories with two-factor authentication
  • Peer review and protected branches before merge
  • Writing code doesn't grant the right to deploy it
  • Infrastructure defined as code, same pipeline
  • A written backout plan for material changes
  • Security advisories reviewed and acted on

Backup and recovery

  • Daily database backups with point-in-time recovery
  • Cross-region replicas of the database and selected storage
  • Documented recovery, exercised in drills
  • Recovery time and recovery point set in your agreement

Incident response

  • One documented process, whatever the source
  • Triage, containment, recovery and corrective action
  • You're notified within your agreement's timeframe if your data is affected
  • Notices cover what happened, what was done and what's next
  • Exercised through tabletop and technical drills

Retention and deletion

  • Production keeps only approved records
  • Temporary files are never long-term records
  • Deletion within your Data Processing Agreement's timeframe
  • Operational records kept separate from your data

Security is shared. Here's the line.

Our controls protect your data once it's inside the platform. They can't replace the controls on your side, so here's who owns what.

What we take care of

  • Hosting, network and platform security
  • Encryption in transit and at rest
  • Access control for our people and systems
  • Logging, monitoring and incident response
  • Change management, backups and disaster recovery
  • Deleting temporary files and honoring deletion requests

What we ask of you

  • Send only files and datasets you've approved
  • Leave out sensitive personal data we don't need
  • Protect the credentials issued to your users
  • Approve any connection to your systems first
  • Tell us when your users or contacts change
  • Review generated catalogs, pricing and quotes before production use

Documentation for your review

This page is the summary. In a security review, you get the documents behind it, and we answer your questionnaire as things actually stand.

PDF · under NDA

Technical white paper

The hosting model, trust boundaries and operating controls in full. Shared under NDA.

MSA · DPA · SOW

Your agreements

Master Services Agreement, Data Processing Agreement and Statement of Work. They're authoritative wherever they cover the same ground as this page.

Your format

Your questionnaire, answered

Completed in full. Any partial answer says exactly what is and isn't in place.

Live session

Time with our technical lead

An architecture and data-flow walkthrough with your security team, at any stage.

On certifications: Intelli.Build doesn't hold SOC 2 or ISO 27001 certification today. In your review, we'll share where our compliance program stands and when each item is due.

What manufacturers and distributors ask us

Can a competing distributor see our pricing?

No. Each customer's environment is isolated, and no customer, partner or reseller can see into another's catalogs, pricing, quotes or customers.

Will the manufacturer see our customers?

No. Where your agreement provides for it, a sponsoring manufacturer sees aggregated, non-personal analytics, such as which products and assemblies are being configured. Never your individual customers.

Does our data train an AI our competitors use?

No. We don't train or fine-tune models on customer data, and our model providers' API terms exclude inputs from training.

Who owns our catalog, configurations and quotes?

You own your customer and configuration records. Ownership and access terms are written into your agreement.

Do you need access to our ERP or network?

No. There's no connection by default, and a trial can run on exported files. Any integration is scoped, approved and documented first, with credentials limited to that purpose.

Where is our data, and is it backed up?

On Amazon Web Services, managed by us, with daily backups, point-in-time recovery and copies in a second AWS region.

What happens to our files after a trial?

Temporary source, drawing and geometry files are deleted after processing. Trial data doesn't become production data unless you approve it, and you can request deletion under your Data Processing Agreement.

What if there's a security incident?

If a confirmed incident affects your data, you're notified within the timeframe in your agreement: what was affected, the known cause, what was done and what's planned.

Running a security review on Intelli.Build?

Tell us what you need. We'll answer your questionnaire in full, share our technical documentation under NDA, and put our technical lead in front of your security team.

  • Your questionnaire, answered as things actually stand
  • Technical white paper and agreements for review
  • An architecture walkthrough with our technical lead

Back to Intelli.Build

Start a security review

We reply within one business day.

We use your details only to arrange your review.