Bluebeam Security & Data Residency

Yes. We have a Data Processing Agreement aligned with GDPR Article 28, a dedicated Data Protection Officer, and European contracting entities. Cross-border transfers are covered by the EU-U.S. Data Privacy Framework.

Yes. Single Sign-On (SSO) is supported across Revu, and Bluebeam on web and mobile, with multi-factor authentication through your identity provider. Microsoft Entra ID and Okta Workforce Identity Cloud are officially supported; a minimum of 10 seats is required for SSO configuration.

Your Bluebeam ID is a centralised identity used to sign you into Revu and verify your licence. The account record (your email, credentials, licence entitlement and basic settings) is held in our central authentication system and can be accessed and processed from outside the EU by Bluebeam for account management, audits, or authentication. No project files or content are stored or transferred there. Cross-border transfers of this identity data are covered by the EU-U.S. Data Privacy Framework.

For Bluebeam-hosted services (Studio and the licensing system), our security team monitors continuously, follows a documented Incident Response Plan, runs monthly vulnerability scans, and commissions an annual third-party penetration test. Revu runs on your machines, so endpoint security there is your responsibility.

To date, Bluebeam has not received a government request for customer data. Should one ever come, any request, including from US or other non-EU authorities, is carefully scrutinised. Customers are notified where legally permitted, and requests are challenged where there are reasonable grounds to consider them unlawful.

For fully air-gapped environments, Revu Offline is a separate subscription with no external communication, licensed to a designated machine. Reach out to your Bluebeam account team for more information.