Last Updated: July 30th 2026
Scope3D protects your building data with encryption,
access controls, and ownership you keep.
Your files and twin stay encrypted in
transit and at rest — building data
stays protected.
Nobody joins your account on their
own. You invite people by email, and
a role decides what they can do.
The twin is yours, not ours —
your building data stays under your
control.
The twin exports as open IFC — the
format Revit and other BIM tools
import. No lock-in.
We will not put a badge on this page for something we
have not earned. Two things we can state plainly:
No compliance language, no frameworks we are not audited
against. Just the six things that protect your building data.
Your drawings, your models and everything you write against them travel over TLS and sit encrypted at rest. That covers the upload, the twin and the documents attached to it.
There is no open sign-up into your account. You invite a person by email, they get a seat, and you can withdraw it the same way when the job ends.
Roles and seats are separate rights. Reading the twin, editing geometry and exporting the model are not the same permission, so a stakeholder who needs to look does not get the ability to change.
Buildings belong to your organisation, and access is granted against them. One property can be transferred or handed over on its own without opening the rest of the portfolio.
Every row carries the organisation it belongs to and the database enforces that boundary itself. A mistake in the interface cannot hand you another account's building, because the interface is not what is holding the line.
Connected services are stored as a reference, never as a copy of the key sitting next to your building records, and the endpoints that change anything run behind a server-side guard.
A security page is only worth forwarding to your IT team if it lists the gaps as well. These are ours today.
No SOC 2 report, no ISO 27001 certificate, no published penetration test. When there is one, this page will name the auditor and the date rather than show you a logo.
Sign-in is email and password, with invitations, roles and seats. If SAML single sign-on is a hard requirement for your organisation, say so before you buy, not after.
There are no endpoints to call and no keys to issue. Data comes in as files — IFC, Revit, DXF, PDF drawings, plan images, STEP — and leaves as IFC.
Encryption, invitations and roles, and an IFC
export you can run yourself.
Bring the files you already have. We will show you the twin you keep for the life of the building.