Security

Last updated: 26 July 2026.

This page describes how Kestrel™ handles your work, what we hold on our own systems, and how to report a security issue. It is written for the estimator who wants a straight answer and for the IT person who has been asked to sign off on new software. If something here does not answer your question, email [email protected] and we will answer it properly.

Your drawings and measurements stay on your PC

Kestrel is a Windows desktop application, not a web app. Each project is a database file on your own machine, alongside the PDFs you loaded. Your drawings, your measurements and your priced Bill of Quantities are not uploaded to us, and we cannot see them. If you uninstall Kestrel, your project files are still yours and still there.

This is a deliberate design decision rather than a limitation. Tender drawings are commercially sensitive, often under a confidentiality agreement, and the safest place for them is the machine they already sit on.

What we do hold

Enough to sell you a licence and support it, and no more:

• Your account record. Email address, licence key, which machine the licence is activated on, and when you accepted the terms. Held in a Cloudflare database in the EU.
• Payments. Handled entirely by Stripe. We never see, receive or store your card details.
• Crash diagnostics. If Kestrel crashes it can send a technical error report so we can fix the fault. These carry stack traces and version information, not your drawings.
• Email. Licence keys, receipts and support replies are sent through Postmark.

The full detail, including your rights over that data, is in our Privacy Notice.

The installer is signed

Every Kestrel installer we publish is code signed with a certificate issued to Alves Rowe Ltd after Microsoft validated our company identity, and each signature is timestamped. Before you install, you can right-click the installer, choose Properties then Digital Signatures, and confirm it says Alves Rowe Ltd. If it does not, do not run it, and please tell us.

Updates are served over HTTPS, and every update is code signed with the same certificate as the original installer, so you can check any of them the same way.

The AI features are optional, and use your own key

Kestrel can read a scale off a title block or suggest finishes from a drawing. Those features are off until you turn them on, and they run on an API key you supply and control from your own account with the AI provider, Anthropic. That means the request goes from your machine to them; we sit outside the path and never receive the drawing. Turn the features off and no drawing content leaves your PC for that purpose at all.

Providers we rely on

We are a small company and we use established providers rather than running our own infrastructure. The ones that touch customer data are Cloudflare (hosting, database, storage), Stripe (payments), Postmark (email), Sentry (crash reports), Microsoft (our own email), and Anthropic (only when you enable the AI features, using your own key).

Operational practice

• Data in transit is encrypted with HTTPS throughout, including licence checks and updates.
• Administrative sign-in requires a time-based second factor, and repeated failed attempts are locked out.
• The licence database is backed up on a schedule to private storage, and each backup is read back and checked rather than assumed.

That is not a complete list of what we do, and it is not meant to be. If you need specifics for a supplier assessment, ask and we will answer them directly rather than publish a checklist we would have to keep in step.

Reporting a security issue

If you think you have found a vulnerability in Kestrel, in takeoff.alvesrowe.com, or in any of our services, please email [email protected] with enough detail to reproduce it. Machine-readable contact details are at /.well-known/security.txt.

What to expect: we will acknowledge your report within three working days, tell you whether we can reproduce it, and keep you informed while we fix it. We do not run a paid bug bounty, but we are glad to credit you when a fix ships if you would like us to.

We ask that you give us a reasonable chance to fix the issue before publishing it, and that you do not access, change or delete other people's data while investigating. Test against your own account. We will not pursue anyone who reports a genuine issue in good faith and follows that.

Who we are

Alves Rowe Ltd, registered in England and Wales (Companies House number 16682818). Registered office: 44 Belmore Road, Eastbourne, BN22 8BL, United Kingdom. VAT No. GB 520 3368 24.