Security

Infrastructure and Encryption

• Our API and production database run on Amazon Web Services (AWS). The database is Amazon Aurora PostgreSQL, with a replica in a second AWS region, and its storage is encrypted at rest with keys managed by AWS Key Management Service (KMS). Files we store in Amazon S3 are encrypted with AES-256.
• Automated database backups, with point-in-time recovery, are kept for 30 days.
• The ProhostAI web app and API are served over HTTPS only, using TLS 1.2 or TLS 1.3; older TLS versions are refused. Traffic between our own services runs inside private networks or over TLS.

Credentials and Secrets

• Tokens for the bank and card accounts you connect, and other integration credentials, are encrypted a second time inside the application, with a key unique to each workspace, on top of database encryption. Every time one of these credentials is decrypted, the access is logged.
• Production secrets, such as API keys, are kept in a dedicated secrets manager and delivered to our servers through AWS Secrets Manager and our hosting provider's secret store. Reaching them requires single sign-on with multi-factor authentication, and they are never committed to source code.

Access Control

• Access inside ProhostAI is role-based. Each workspace has an owner; admins can use every feature, and other members are given access one feature at a time, to read or to change.
• Multi-factor authentication is available to every user.
• Our own staff work on least privilege: nobody has access by default, access is granted only for a job that needs it, and access to production systems is reviewed every quarter. Signing in to production systems requires single sign-on and a hardware-backed second factor, such as a security key or passkey.
• Ad-hoc queries against production data need an on-call justification, and changes to workspace memberships and permissions are recorded in an audit log. When someone leaves ProhostAI, their access is removed the same business day.

Connected Accounts

• When you connect a bank or card account, we ask the provider for read-only access wherever it offers it.
• Disconnecting a bank or card account revokes our access with the provider and deletes the stored credentials. Data imported through the connection is deleted under our data retention policy.

Vulnerability Management

• GitHub Dependabot watches our dependencies for published security advisories and proposes patches. Dependency versions are pinned with lockfiles, and our container images are rebuilt on every deploy.
• Pull requests run automated security checks, including static analysis and an AI-assisted review of the change.
• We aim to patch critical vulnerabilities in our dependencies within 7 days and high-severity ones within 30 days.
• Our engineers' laptops use full-disk encryption.

People and Vendors

• Everyone at ProhostAI completes a security awareness review when they join and at least once a year after that. Engineering hires pass a background check before they are given access to production systems.
• We review the security of each service provider before it receives customer data, and our providers are bound by confidentiality and breach-notification terms.

Incident Response

Suspected security incidents are handled by our on-call engineer, with our CEO coordinating the response: we contain the issue, remove its cause, recover, and write a post-mortem for every incident that affects customers. If an incident materially affects your data, we notify you within the time applicable law requires.

Reporting a Security Issue

If you believe you have found a security vulnerability in ProhostAI, please email team@prohost.ai with enough detail for us to reproduce it, and give us a reasonable chance to fix it before sharing it publicly. Our contact details are also published at /.well-known/security.txt.