Your estimating files hold years of hard-won knowledge: unit costs, labor productivity, supplier pricing, markup strategy, and the actual numbers behind every win and loss. In a competitive bid market, that information is worth real money to a rival, and it is often stored in places with very little protection.
Estimating data leaves a company in two ways. Sometimes it is stolen by an outsider who compromised an email account or laptop. More often it simply walks out with a departing estimator or a well-meaning employee who forwards files to a personal account. Both are preventable.
Know where the data lives
Start by mapping it. Estimating data tends to be spread across more places than anyone expects.
- Estimating software databases and cloud workspaces
- Spreadsheets on shared drives and individual laptops
- Email attachments and sent bid packages
- Takeoff and plan files downloaded from plan rooms
- Subcontractor quotes arriving by email, text, or portal
- Personal phones used for photos and quick notes
You cannot protect what you have not found. Walk through a recent bid with the lead estimator and trace where each file was created, stored, and sent.
Limit access to what people need
Use role-based access
Not everyone needs the full historical database. Give project managers and field staff access to the jobs they work on, and reserve full cost history and markup data for estimators and leadership. Review this list at least twice a year.
Separate current bids from archives
Active bids should be tightly controlled until the bid date. Archived jobs can be kept read-only with narrower access. This limits both accidental edits and exposure.
Use named accounts
Shared logins to estimating tools make it impossible to know who exported what. Every user should have their own account with multifactor authentication enabled.
Control how files leave the building
- Restrict personal email and cloud storage on company devices where practical, and give staff a sanctioned way to share files so they do not improvise.
- Use secure sharing links with expiration dates and access restrictions rather than attaching raw files to email.
- Turn on logging for file downloads and sharing in your cloud storage so unusual bulk activity is visible.
- Protect laptops with disk encryption so a lost or stolen device does not become a data breach.
- Be careful with plan rooms and bid portals. Remove expired invitations and review who still has access.
Handle departures deliberately
Departures are the highest-risk moment for estimating data.
- Disable accounts on the final day, or earlier when the situation calls for it.
- Review recent download and sharing activity for the departing person.
- Collect and wipe or reassign company devices, and confirm no local copies remain on personal devices.
- Remind the employee in writing of confidentiality obligations in their agreement, and consult your attorney on enforceability and wording.
- Rotate shared passwords, API keys, and plan room credentials they knew.
This process should be written down and applied the same way every time.
Watch for outside attackers
Attackers like bid-season email. A fake plan room link, a spoofed owner, or a bogus request for a prequalification form can lead to a stolen mailbox. Once inside, an attacker can read bids, see subcontractor quotes, and even insert themselves into a conversation to redirect a payment.
Turn on multifactor authentication for all email, filter inbound messages for impersonation, and train estimators on the specific lures that target them. Encourage a simple habit: if a link asks for your Microsoft or Google password, close it and navigate directly to the real site.
A short protection checklist
- A documented map of where estimating data is stored
- Named accounts with multifactor authentication everywhere
- Access limited by role, reviewed twice a year
- Encryption on every laptop and phone
- Logging of downloads and external sharing
- A written departure process
- Training that uses real bid-season examples
Where Ironfield Cyber fits
Ironfield Cyber helps contractors lock down estimating systems, configure logging and sharing controls, and build departure checklists that actually get used. If you would like a review of where your bid data sits and who can reach it, we are happy to walk through it with your estimating team.