Trust Center
Security and Trust
Prova is used in regulated industries to produce auditable records of AI reasoning. We take security and data privacy seriously.
SOC 2 Type II
In progressProva is currently undergoing SOC 2 Type II certification. Contact us for our current security posture documentation and timeline.
Security
Encryption in transit
All traffic is TLS 1.2+. API endpoints enforce HTTPS.
Encryption at rest
Supabase encrypts data at rest using AES-256.
Authentication
Supabase Auth with email/OAuth. API keys are stored as SHA-256 hashes only -- the raw key is never retrievable.
Access control
Row-level security on all tables. Service role key is server-side only, never exposed to the browser.
Secret management
Environment variables managed via Vercel and Render. No secrets in source code or version control.
Vulnerability disclosure
Report issues to security@cobound.dev. See security.txt.
Data Practices
What we store
Certificates (verdict, argument graph, confidence score, SHA-256 hash) are stored permanently. Reasoning text is stored alongside the certificate by default.
retain=false
When retain=false is set in an API request, the reasoning text is processed in memory and never written to disk. Certificate metadata is always stored for the certificate to remain valid.
Certificates are permanent
Certificates are never deleted. This is by design -- a certificate is a timestamped formal record. Invalidating it retroactively would undermine the auditing use case.
EU data residency
Available on Enterprise plans. All data (reasoning and certificates) stored in Supabase EU region, ensuring no data leaves the EEA. Contact us for details.
Documents
Questions about security or compliance?
Our team responds to enterprise security reviews within one business day.