# ClaimStack

Commercial operating system for construction connecting procurement, variations, claims, and forecasting.

Research: https://www.safecli.org/company/claimstack.com.au
Company: https://claimstack.com.au

## Evidence status

Procurement review needed
Source review: 2026-11-06T15:01:09.744Z
API: API mentioned

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Company-published

> SOC 2 Type II

Source: https://claimstack.com.au/security
Reviewed: 2026-11-06T15:01:09.744Z

> - They're ahead on a few things and we won't pretend otherwise: SOC 2 Type 2, Jobpac and Cheops integrations, a guided 90-day implementation, and a much longer track record on very big jobs.

Source: https://claimstack.com.au/blog/claimstack-vs-procurepro
Reviewed: 2026-11-06T15:01:09.744Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Company-published

> - Role-based access controls (RBAC)

Source: https://claimstack.com.au/privacy
Reviewed: 2026-11-06T15:01:09.744Z

- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> Immutable audit trails, document retention, and multi-party data isolation

Source: https://claimstack.com.au/security
Reviewed: 2026-11-06T15:01:09.744Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Company-published

> Australian Data Residency

Source: https://claimstack.com.au/security
Reviewed: 2026-11-06T15:01:09.744Z

> Each is bound by data processing agreements and subject to ongoing security review.

Source: https://claimstack.com.au/security
Reviewed: 2026-11-06T15:01:09.744Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> Monitoring & Incident Response

Source: https://claimstack.com.au/security
Reviewed: 2026-11-06T15:01:09.744Z

> - Automated backup and disaster recovery

Source: https://claimstack.com.au/privacy
Reviewed: 2026-11-06T15:01:09.744Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: