Where is your data stored?
Santix's database and file storage run on Supabase in the Frankfurt (EU) region. Drawings, pins, photos, schedule, budget and documents are stored there. DWG, DXF and PDF files you upload are split into sheets on Santix's own CAD server on Google Cloud Run in Frankfurt (europe-west3); neither the Autodesk cloud nor any other CAD service is used.
AI requests and this website run on Cloudflare Workers. Messages sent through the site's contact form are stored in a Cloudflare database.
| Service | Used for | Region |
|---|---|---|
| Supabase | Database, files, authentication | Frankfurt (EU) |
| Google Cloud Run | Drawing processing (DWG, DXF, PDF) | europe-west3, Frankfurt |
| Cloudflare Workers | Relay server for AI requests, website, contact form | Cloudflare network |
| OpenAI | Only AI suggestions that are put to you for approval | OpenAI infrastructure |
Who can see what?
Access in Santix depends on role, and the rule is enforced in the database with row-level security rather than on screen. A record a user is not allowed to see is never sent from the server to their phone.
- A subcontractor sees only tasks assigned to them, their own contract, their own bid and their own documents.
- Budget, contract values and bid prices are never inherited from a higher role. By default the owner, project manager and site manager see the budget; others can be given none, summary or full access per role or per person.
- Architects and subcontractors get project-scoped roles; organisation settings, billing and other projects stay hidden from them.
- People join with an 8-character invite code valid for 14 days.
The full table is on roles and permissions.
What does the app not collect?
Santix does not collect your location and does not use GPS. The app has no ads, no advertising identifier, no tracking and no third-party analytics SDK. The data we hold is the data you enter to run the project: drawings, notes, photos, documents and your account details.
Records entered offline wait on your device until the connection returns, then sync.
What data goes to AI?
AI is used only to produce suggestions in specific features, and a user approves every suggestion. Requests go to OpenAI from Santix's server on Cloudflare, not directly from the app. OpenAI is told not to store the request (store=false), and no user id is sent.
| Feature | Data sent |
|---|---|
| Room schedule matching | The PDF or Excel room schedule you upload and room names read from the drawing |
| Reading dates and numbers from documents | The content of the document you scan |
| Excel estimate column mapping | The column headers and rows of the Excel file |
| Contract questions | Your answers for the contract draft |
| Bid comparison summary | Vendor names, bid totals, duration, payment terms, score and bid notes |
| CAD layer classification | Layer and block names; drawing geometry is not sent |
If a document you scan contains personal data, such as worker lists or health reports, that content goes to the AI too. Keep this in mind before scanning such documents.
What happens if you delete your account?
You can delete your account in the app under Ayarlar › Hesabımı sil (Settings › Delete my account). Your personal account is deleted; records you created in the organisation's projects, such as pins, comments, approvals and uploaded drawings, belong to the organisation and stay there.
If the subscription ends, or no plan is chosen after the trial, the account becomes read-only and no data is deleted. To have organisation data deleted or handed over, write to destek@santix.app.
Who is who under KVKK?
KVKK is Türkiye's personal data protection law. For data a customer enters into its projects, the customer firm is the data controller and Santix is the data processor, processing that data only to provide the service. For account, contact and billing data, Santix is the data controller.
| Data | Controller | Processor |
|---|---|---|
| Project data: drawings, notes, photos, documents, budget | Customer firm | Santix |
| Account and billing data | Santix | Santix's service providers |
| Website contact form | Santix | Cloudflare |
Transfers abroad
Because data is stored in Frankfurt in the EU, personal data is transferred abroad. Under Article 9 of KVKK, the standard contract process for this transfer is under way.
Details are in the KVKK notice, privacy policy, terms of use and cookie policy.
Which certifications do you hold?
Santix holds no security certification such as ISO 27001 or SOC 2. The infrastructure providers we use have their own certifications, but that does not make Santix certified. Send security questions or vulnerability reports to destek@santix.app.
Frequently asked questions
Are our drawings processed on another company's server?
Drawings are processed on Santix's own CAD server, which runs on Google Cloud Run in Frankfurt (europe-west3). The Autodesk cloud is not used.
Does OpenAI use our data to train models?
Santix sends requests to OpenAI with storage turned off (store=false) and without a user id. Only the data needed for that one suggestion is sent, and only in features that make suggestions.
Is Santix a data processor or a data controller under KVKK?
For data you enter into projects, Santix is the processor and your firm is the controller. For account and billing data, Santix is the controller.
Is Santix ISO 27001 certified?
No. Santix holds no ISO 27001 or SOC 2 certification. Certifications held by infrastructure providers do not cover Santix itself.