How your photos are stored
Plain answers to the questions insurers, GCs and careful owners ask.
The original is sacred
The phone saves exactly the bytes the camera produced (HEIC, JPEG or MOV) with the EXIF data intact: time, GPS position, device. Before anything else happens it computes a SHA-256 hash of that file. The hash travels with the photo and is checked when the server receives it.
The copy with the timestamp and address burned in, the thumbnail, and any annotated version are separate files. Annotations are stored as a layer of shapes on top of the original, so an arrow or a blur never changes the photo underneath.
What "documented" means here
Jobsite records when and where a photo was taken and keeps the file unaltered. We say documented, timestamped, originals preserved and verification hash. We do not say "proof", "court-ready" or "legally binding" — whether a record is accepted is up to the people and processes on the other side.
Location
Location is used for two things: filing a photo to the job you are standing at, and offering to start a job when you arrive. There is no background location history and no map of where your crew is. The arrival prompt uses the phone's region monitoring for up to 20 nearby jobs.
Who can see what
- Every photo belongs to one company; every request is scoped to it.
- Photos are served through short-lived signed links (15 minutes for the app, an hour for share pages). Nothing is public by URL guessing.
- Share links are 128-bit random tokens, created on purpose, revocable instantly, and expire 90 days after a job completes by default. Downloads and full-size originals are per-link switches. The pages carry no third-party scripts and are marked not to be indexed.
- Partner sharing gives another Jobsite company read access to one job; either side can end it.
Tags, text and faces
Tag suggestions, text recognition (labels, meters, receipts) and face detection run on the phone with Apple's on-device frameworks. Face detection is used only to warn "this photo has faces, share carefully" and to offer the blur tool. Nothing identifies anyone.
The optional AI draft
The daily-log draft is written from text only: counts, weather, checklist progress and your own notes. No photo ever leaves for an AI service. The provider operates under zero-retention terms. The draft is always editable and the feature has an off switch per company.
Getting your data out
Export a job or the whole company any time. The ZIP contains originals/, annotated/, reports/, assets.csv, logs.csv, comments.csv and manifest.json, which lists every file with its size and SHA-256. Verify any file with shasum -a 256.
Retention and deletion
See the data retention page for the exact rules: history limits by plan, the 30-day undo for deleted photos, archive before anything is removed, and company deletion with a grace period.
Where it runs
Photos are stored on servers operated by Illuminant Inc. in the United States, encrypted at rest, backed up nightly with encrypted backups kept for 30 days.