How to protect BIM projects, contracts and data in real estate

The documents that hold the value of the project and leave the company by design: BIM models and technical drawings, bills of quantities and tender bids, main and subcontract agreements, deeds and registry records, personal data of buyers and tenants. In construction, internal data appears in 80% of breaches and credentials in 31%; in real estate, personal data rises to 43% (Verizon DBIR 2026). The goal is not to stop the file from leaving, since that is the work itself. It is to keep it encrypted, tracked and revocable after delivery.

By encrypting the file rather than the channel. With FileGrant the document is created encrypted inside a vault and shared through a link with RBAC permissions set separately for each design firm, contractor and supplier, expiry tied to the project phase, and blocking of downloads, printing and screenshots. Every open lands in an audit trail with user, timestamp and IP. When a subcontractor leaves the project, access closes in one click, with no need to ask anyone to delete the files they already downloaded: the copy in their hands stays encrypted and unusable.

It depends on the role. Operators of major works and critical infrastructure such as ports, airports and railways fall within the essential or important entity scope set by Italian Legislative Decree 138/2024, in force since 16 October 2024. Construction firms and property companies outside the direct scope still get pulled in as suppliers: the duty to manage supply chain risk turns into contractual security requirements imposed by in-scope clients. The current operational reference is ACN Determination 127437 of 13 April 2026, with measures due by October 2026. On the procurement side, the Italian Public Contracts Code (Legislative Decree 36/2023) rewards security certifications such as ISO 27001 in tender scoring.

By taking the value out of the mistake and out of the interception. The human element is present in 62% of breaches, and delivery to the wrong recipient remains the leading internal error (Verizon DBIR 2026). With EmailGrant, a FileGrant module, the message and its attachments stay encrypted inside the platform, access can be revoked after sending, expiry can be scheduled, and every open is logged with an IP. Bank details for a closing can travel behind an extra password that not even the administrator can bypass. The Pepco case shows the worst version of this risk: a single email moved USD 16.7 million.

By offering an alternative people actually use. 45% of employees now use AI tools on corporate devices, up from 15% the year before, and 67% do so through non-corporate accounts (Verizon DBIR 2026). Bans do not hold. AIGrant is a private on-premise AI that only works on documents the user can already access, segregated by project, while FileGrant blocks external models from scraping protected content. Widespread shadow AI adds an average of $670,000 to breach costs, and 97% of AI-related breaches involved systems that lacked proper access controls (IBM Cost of a Data Breach 2025).

No, it sits alongside them. FileGrant does not replace the common data environment you already run: it adds the protection that disappears once a file leaves, meaning persistent quantum-safe encryption, revocation after sharing, screenshot and AI scraping blocking, and a per-document audit trail. AIGrant likewise does not replace Copilot: it covers the cases where project data cannot leave the network. Deployment is modular, works with legacy systems, and requires no reconfiguration of existing infrastructure and no migration of project archives.