SOC2
Independently audited.
Trust center
Security at Prograils
This page is the single source of truth for how Prograils protects customer data: the compliance programs we maintain, the vendors we rely on, and the documentation available for your security review.
Compliance programs
Current status of the frameworks we maintain or are actively pursuing.
Security practices
Implemented practices are backed by automated evidence or a documented internal review.
-
Implemented
Encryption at rest
Customer data is encrypted at rest on the cloud resources we monitor.
Continuously monitored · Amazon Web Services · checked Sep 25, 2026
-
Implemented
Encryption in transit
Connections to the endpoints we monitor are encrypted with TLS.
Continuously monitored · Cloudflare · checked Oct 6, 2026
-
Implemented
Multi-factor authentication
Multi-factor authentication protects workforce access to the systems we monitor.
Continuously monitored · Amazon Web Services, GitHub, Google Workspace · checked Oct 9, 2026
-
Implemented
Access control
Access to our systems is restricted by role and governed by an access control policy.
Continuously monitored · Amazon Web Services, GitHub · checked Sep 25, 2026
-
Implemented
Logging and monitoring
Security-relevant activity is logged on the systems we monitor.
Internally reviewed · Oct 13, 2026
-
Implemented
Backups and recovery
Backup and recovery measures are in place for production data.
Internally reviewed · Oct 9, 2026
-
Implemented
Vulnerability management
Automated scanning finds vulnerabilities in the code and infrastructure we monitor.
Continuously monitored · GitHub · checked Oct 12, 2026
-
Implemented
Secure development
Code changes follow a controlled, tracked development process.
Continuously monitored · GitHub, Shortcut · checked Oct 1, 2026
-
Implemented
Endpoint security
Company devices are centrally managed, with security settings enforced.
Continuously monitored · FleetDM · checked Oct 6, 2026
-
Implemented
Vendor management
Vendors that handle our data are reviewed for security.
Tracked in AuditBadger · verified Oct 9, 2026
-
Implemented
Incident response
A documented process defines how we handle security incidents.
Tracked in AuditBadger · verified Oct 9, 2026
-
Implemented
Security awareness training
Security awareness training is in place, and completion is tracked.
Tracked in AuditBadger · verified Oct 9, 2026
Subprocessors
Third parties that support our service and the role each one plays.
| Vendor | Purpose | Headquarters | Criticality |
|---|---|---|---|
| Cloudflare | Cloud infrastructure | — | Critical |
| Hetzner Online GmbH | Cloud provider assurance | Gunzenhausen, Germany | Critical |
| ubicloud | Managed database provider assurance | — | Critical |
| Amazon AWS | Cloud provider assurance | — | High |
| Anthropic | AI / model provider assurance | — | High |
Documents
Public documents download instantly. Restricted documents are shared after we countersign your NDA.
SOC2 – Audit report
SOC2 · Audit report · PDF
NDA required
Request access
NDA required
Request access
Need the full reports for a security review?
Request access with your work email. We countersign your NDA and grant access to the restricted documents, typically within 2 business days.