Security

Provenance handles the most sensitive information in finance, live deal models, diligence data rooms, and the material non-public information (MNPI) behind every investment decision. Protecting it isn't a feature; it's the product.

Our Trust Center has live compliance status, our controls, and audit reports, and lets you request our SOC 2 Type I report under NDA.

SOC 2 Type I

Independently audited; Type II underway.

AES-256 at rest

Databases, storage, and backups encrypted.

TLS 1.2+ in transit

HSTS enforced on every connection.

Organization isolation

Your organization is the access boundary.

AI providers disclosed

Each one that receives deal content is named.

Immutable audit trail

Append-only record of every change.

• SOC 2 Type I across Security, Availability, and Confidentiality; the Type II audit is in progress.
• Controls monitored continuously, not just at audit time.
• Reports and DPAs in our Trust Center.

• TLS 1.2+ in transit, with HSTS on every connection.
• AES-256 at rest across databases, storage, and backups.
• Keys in hardware-backed key management, rotated regularly.

• Hardened, SOC 2-compliant cloud, hosted in the US.
• Managed PostgreSQL with backups and network isolation.
• Global edge with automatic TLS and DDoS protection.

• Your organization is the access boundary: every member can open every deal in it, and no one outside it can, apart from guest reviewers you send a single review to and signed-in people a member shares a single comparison with, for seven days.
• Provenance does not wall off deals from members of the same organization.
• App-level checks confirm organization membership on every request for deal data, and your role on every change.
• Database row-level security adds a second, organization-level check for most deal data.

• Single sign-on through Microsoft and Google.
• Your own MFA and offboarding policies apply automatically.
• Staff don't access customer data by default.

• Depending on the feature and the model that answers, deal content goes to Google Cloud (Vertex AI, Document AI), OpenAI, xAI, or Anthropic. Our Privacy Policy lists every provider and what it receives.
• The assistant can search the public web through Google; the model writes those queries itself.
• AI features only see what the signed-in user can already open: any deal in their organization.
• Optional voice dictation sends audio to OpenAI for transcription; we never store the audio.

• Every change recorded in an append-only trail.
• See exactly what moved between versions.
• Evidence packages for your own compliance needs.

• Hardened HTTP headers, including HSTS.
• Rate limiting and abuse protection on auth and API.
• Input validation against injection and XSS.

• Mandatory review on security-sensitive changes.
• Automated tests, linting, and type checks before every ship.
• Secret and dependency scanning, patched quickly.

• Continuous automated scanning.
• Periodic third-party penetration testing.
• Findings triaged by severity and tracked to fix.

• Deleting a deal, model, data room, document, or organization takes it out of the app's lists and pages right away.
• Deleted deals, models, data rooms, and documents are erased within 14 days, with their stored files. A deleted account loses its sign-in identity, email address, and uploaded files in the same window; its name stays as attribution. Backup copies expire on their normal rotation.
• Deleting a single version erases its record, comments, and computed changes; the audit trail records the deletion.
• Ending your agreement is not the same as deleting: for 30 days after it ends you can ask us to export or return your content, as section 12 of our Terms of Service describes. After that we delete it.
• What deletion keeps, and how to ask about erasure, is in our Privacy Policy.

• Automated backups with point-in-time recovery.
• Redundant infrastructure built to tolerate failures.
• Monitoring and synthetic checks catch issues fast.

• Security training and confidentiality for all staff.
• Least-privilege access, revoked promptly on departure.
• Vendors reviewed for security before any access.

• Documented detect, contain, and recover process.
• We notify you without undue delay if your data is affected.
• You get the information you need to meet your obligations.

Found a security issue? Email support@provenancexl.com with steps to reproduce, and please hold off on public disclosure until we've had a chance to fix it. We aim to acknowledge within two business days.

Security research is welcome when it follows these rules:

• Test only accounts and organizations you own or are authorized to use.
• Don't access, change, or keep data that isn't yours. If you reach any, stop, delete what you have, and tell us.
• No denial-of-service or load testing, spam, social engineering, or attempts against our staff, offices, or vendors.
• Give us a reasonable time to fix an issue before you disclose it publicly.

Research that follows these rules is permitted under section 6 of our Terms of Service, and we won't pursue legal action over it.

• Compliance status & reports: Vanta Trust Center
• Security, compliance & DPA: support@provenancexl.com
• General support: support@provenancexl.com
• Privacy Policy · Terms of Service