Role-based access, MFA for administrative accounts and controlled production access.
Trust · Security · Privacy
Security and privacy that buyers can inspect.
See where data is stored, how it is protected, who can access it and which documents support security, privacy and procurement review.
The short answer
Three things a security review asks first.
The detail behind each one is below, and every statement here is backed by a versioned document you can download without talking to us.
Purpose-bound retention, export, deletion and support for individual rights.
Incident, continuity, provider and assurance positions available for review.
Residency and processing
Where data lives and who touches it.
The system of record is hosted on AWS in Ireland, with backups retained in-region. Data published into customer systems remains under the customer's own agreements.
System of recordAWS - Ireland
Database, authentication, storage and in-region backups.
ProviderPurposeProcessing position
Supabase on AWSDatabase, authentication and storageAWS - Ireland
VercelApplication hosting and deliveryEU-configured; deployment details supplied in the DPA pack
OpenAIDrafting, narration, retrieval and transcriptionThe approved regional processing route and transfer position are disclosed per engagement
Transactional emailSystem notificationsNames and email addresses only; provider details supplied per engagement
The production-derived sub-processor register is versioned. Material additions or replacements are notified to client contacts with 30 days' notice and a reasonable right to object.
Retention and deletion
What is kept, for how long and how it ends.
Persistence supports the commercial record. Retention remains purpose-bound, exportable and subject to a defined end-of-service process.
Persists during the subscription
The evidence record remains available for the purpose it was collected for.
Purpose-bound retention
Evidence sources remain resolvable; items that create no evidence are removed after the configured window.
Metadata, never content
No brief, evidence text or email body is written to operational logs.
Export, then verified deletion
A machine-readable export window is followed by deletion and written confirmation.
Identity removed, auditably
Verified erasure removes identifiers while preserving the non-identifying structure of the record.
Built around attribution
Access, correction and erasure requests can work back to the person, record, date and source.
For buyers
What PROOF holds about people on the other side of a deal.
PROOF records selected business facts and keeps the source visible. It does not passively monitor, profile or infer sentiment about individuals.
- Names, business contact details, meeting attendance and deal facts with a named source can be retained when a person deliberately provides the source.
- Buyer-confirmed means the buyer confirmed it. Silence is never treated as agreement.
- Where the Deal Room is enabled, buyers can see and challenge claims made about them; disputed evidence remains visibly contested.
- Access, correction and erasure rights are exercised through the selling organisation, with PROOF supporting the request.
Most sales tools record people without their knowledge. PROOF records claims people confirmed and shows them the record.
Operations
Incidents, continuity and access.
Operational commitments are stated separately from product architecture so buyers can inspect both.
Without undue delay
Confirmed incidents affecting customer personal data are reported to the nominated contact, with rolling updates. Security reports: security@proofhq.io.
In-region recovery
Daily backups and point-in-time recovery support restoration. State published to the CRM remains in the customer's system of record.
Named, minimal and accountable
No support team has standing content access. Necessary access is restricted, logged, time-bound where possible and protected by MFA.
Where we are, honestly
PROOF does not yet hold SOC 2 or ISO 27001 certification; certification remains on the roadmap. A signed DPA is standard with every subscription, with TOMs and security questionnaires available per engagement.
Trust document library
Use the document that answers the review.
The concise Overview is the public starting point. Detailed, versioned statements support security, privacy and procurement review without mixing policy, operations and contractual terms into one file.
Public overview · v1.1
Trust and Security Overview
The concise website document covering architecture, data, AI, privacy and assurance.
Download PDF Public and procurement · v1.1AI Governance and Processing
OpenAI, human authority, evidence boundaries and protected CRM writes.
Download PDF Public and procurement · v1.1Sub-processors and Data Residency
The current production data path, locations and provider-change process.
Download PDF Procurement · v1.1Retention, Deletion and Data Rights
Retention by data class, customer export, erasure and rights assistance.
Download PDF Procurement · v1.1Incident Response and Continuity
Assessment, notification, recovery and customer continuity.
Download PDF Public buyer-facing · v1.1Buyer Privacy Explanation
What may be held, what is never inferred and how buyers can respond.
Download PDF Procurement · v1.1Security Controls and TOMs
Identity, access, data protection, AI authority and security operations.
Download PDF Template · counsel review requiredData Processing Addendum
A customer-specific template for completion, legal review and signature.
Download templateThat is everything we can tell you without looking at your deals.
The rest depends on yours.
Start the review