Trust Center

• TLS 1.2+ in transit — all connections between your browser and ESXPress are encrypted (HTTPS).
• Encryption where it counts — W-9 tax identifiers are encrypted at rest, the managed database encrypts at the storage layer, and ESX output files use the ESX container format's standard wrapping (a requirement for Xactimate import compatibility, not an at-rest security control).
• Breach notification within 72 hours — if a confirmed breach affects your data, we notify affected users within 72 hours of confirmation, per our policy.
• SOC 2 — in progress — we are actively pursuing formal SOC 2 Type II certification and currently align controls with the AICPA Common Criteria 6 (CC6) framework. We will update this page the day that changes.

We collect only what the product needs: the scope PDFs you upload, the extracted line items, and your account details. Uploaded documents are used to produce your ESX file and are not sold or shared for advertising. You can delete conversions, and our full policy spells out retention, your rights, and how to contact us.

ESXPress uses AI models to read scope PDFs, identify line items, and draft supplement language. Scope XML skips the reading stages entirely — structured data is parsed deterministically, with no AI reading involved in the conversion. AI output can contain errors, which is exactly why every generated file carries verification checks and an accuracy report — and why our AI Disclosure says it plainly: you are solely responsible for reviewing every line item, price, and total before submitting. No claim about AI output is ever “guaranteed correct.”