Security & trust
Security and trust at ProofAware.
The app runs in the EU. Sign-in does not use a password. Important actions are logged.
Where your data lives
This website is hosted on Cloudflare Pages.
The application at web.proofaware.com is operated in the EU.
- Hetzner / Dokploy — compute, database, object storage (Germany / EU)
- Resend — transactional email
Sign-in and access
- Sign in with Microsoft or a one-time email link. ProofAware does not store passwords.
- Roles are Owner, Admin, Auditor and Employee.
- Auditors get read-only access focused on audit and reports.
- API keys belong to the Workspace. They are stored as hashes, limited by scope, and can be revoked.
Evidence and logging
- Every important action is logged.
- Sign-in activity is part of that record.
- Reminder and escalation emails are recorded.
- Content views are recorded.
Your data rights
- A GDPR data export is included.
- You can delete a Workspace after a grace period.
This website
We use PostHog for privacy-friendly, aggregate website analytics (for example page views and clicks on calls-to-action) to understand traffic and improve the site. PostHog runs on EU Cloud infrastructure (data processed in the European Union) and acts as our processor under a data processing agreement.
Our analytics is cookieless: it sets no cookies and stores no information on your device (PostHog runs with in-memory persistence, with autocapture and session recording disabled). We collect no personal data through analytics - no names, email addresses, or account identifiers - and visitor IP addresses are discarded and not stored, so we cannot identify individual visitors.
This website sends strict security headers, including a Content-Security-Policy.
Report a vulnerability
Please use the security contact below. Do not include passwords or certificate codes.
What we don't claim
- ProofAware does not hold an ISO 27001 certificate.
- We do not claim that your organisation complies with the GDPR.
Start free.
Create your account. No credit card required.