Security

How we protect your customer data

ProoN handles real customer calls, and the personal data those calls carry. Here's exactly what we do to keep that data safe, and what we're still working on.

Encryption

TLS 1.2+ everywhere

All HTTP traffic to proon.ai and app.proon.ai is served over HTTPS with TLS 1.2 or higher. HSTS is enforced.

AES-256 at rest

Customer data in our PostgreSQL store and object storage is encrypted at rest with AES-256.

Encrypted call recordings

Call audio recordings (when enabled) are encrypted in transit and at rest; access is gated to the org owner + their granted teammates.

Access controls

Row-level isolation

Postgres Row-Level Security (RLS) policies guarantee one customer's queries never reach another customer's data, even from a privileged client.

Per-action permissions

Internal staff access to your account requires the SPECIFIC permission, not just "is on the team." Refunds, impersonation, prompt edits: each gated separately and audit-logged.

Owner impersonation logged

When ProoN support views your account on your behalf (to debug an issue), the action is logged with who, when, and why. You'll see this in your activity log (coming Phase 3B).

Hosting & uptime

Vercel + Supabase

App + APIs on Vercel (AWS us-east-1). Database on Supabase (AWS us-east-1). Both SOC 2 Type II certified.

Daily backups

Daily automated database backups with point-in-time recovery (~5 minutes RPO). 30-day retention. We've never lost a customer byte.

Status page

Real-time component status at proon.ai/status. Active incidents posted at the top; we email all customers at start, mid-point, and resolution.

Compliance

SOC 2 Type II

In progress

Audit in progress. Estimated completion Q3 2026. Happy to share our gap-analysis and policy library with prospective customers under NDA.

GDPR

Compliant

Customers can export and delete all account data self-serve from /app/settings/data. Full data-processing addendum available.

CCPA

Compliant

California consumer rights honored. "Do not sell" is the ProoN default. We never sell customer data.

TCPA

Compliant

AI phone agents respect Do-Not-Call lists. SMS opt-out is one-tap; consent is captured at signup.

Your data, your control

  • Export anytime

    Download every byte of your account data as JSON from /app/settings/data. No support ticket needed.

  • Turn on 2FA

    Add TOTP-based two-factor auth to your account at /app/settings/security. Works with Authy, 1Password, Google Authenticator.

  • Delete your account

    Self-serve account + organization deletion. Hard delete within 24h; backups purge within 30d.

Found a vulnerability?

Email [email protected] with reproduction steps. We acknowledge within 24 hours and aim to triage and fix within 7 days. Researchers acting in good faith and not destroying or exfiltrating data will be credited (and not pursued legally).

We don't currently run a paid bug-bounty program, but we're happy to send swag, write a public thank-you, or refer you for hire.