Security, and what we will not claim
Current as of 22 September 2026.
A security page is usually a list of badges. This one is a list of mechanisms, because a badge tells you an auditor was satisfied on a date and a mechanism tells you what happens when something goes wrong. Where something is not true yet, it says so.
Your data is separated in the database, not in our code
Every table carries the workspace that owns its rows, and the database refuses to return a row outside the current workspace. This is enforced by the database itself, and the application connects as a role that cannot switch it off.
The important consequence is what happens when we make a mistake: a query that forgets to filter by workspace returns nothing, rather than returning another customer’s contracts. The common bug becomes an empty screen instead of a breach.
Prices sit behind a second permission
Contract values, spend and savings are gated separately from the documents they come from, so somebody who needs to see an agreement does not automatically see what it cost. This is a further restriction on top of workspace isolation, not a filter in the interface.
And when a figure is withheld, the product says it was withheld. A hidden number and an absent number are different facts, and a screen that renders them identically tells a person their workspace is empty when it is merely closed to them. An automated check asks every readable endpoint the same question with and without the permission and fails the build if any answer differs in silence.
The activity log cannot be quietly edited
Every action and every data access is written to an append-only log. Each entry is hash-chained to the one before it within your workspace, so removing or altering an entry breaks the chain from that point on. The database rejects updates and deletes on it outright.
The chain is replayed to prove it, and the replay has already earned its place: it caught three genuine defects in its own implementation while it was being built, including one where concurrent writes could link past each other.
What is not finished: that replay runs when somebody runs it, rather than on a schedule, and our own access to your workspace is not yet written into a log you can read. Both are being built. Neither is true today.
Extraction is checked against the document
When a field is read out of a contract, the model must also return the exact sentence it came from. That sentence is then looked for in the document. If it is not there, the field is rejected rather than shown to you.
This is the single most important thing on this page for a procurement team: it is what stops a confident, well-formatted, entirely invented notice period from reaching a decision you make.
Nothing sends itself
A supplier message is drafted, filed for approval, and sent when a person approves it. An action worth more than the delegation limit for that person’s role is held for a human whatever the autonomy settings say. Mail from a domain that has not been verified is refused rather than sent in a way that would fail authentication and land in spam while looking, to us, like a success.
The smaller mechanics
- Uploads are virus scanned before they are processed, and a positive result quarantines the file.
- Connector credentials are encrypted with a key that lives in the server environment and never in the database, so a copy of the database is inert on its own. It is not a managed key service and there is no automatic rotation, which is an accepted limitation at this stage rather than an oversight.
- Search vectors are computed on our own servers, so searching your documents does not send their text anywhere.
- The most capable and most expensive model tier is banned in this product, enforced in code that refuses to start if it is configured. Reading a contract does not need it, and an expensive default is how a per-document cost quietly becomes a per-customer problem.
What we are not claiming
SOC 2: in progress, not achieved. The evidence trail is being collected and the audit has not happened. We are not going to put a badge on this page for something that has not been assessed.
No single sign-on yet. Sign-in is email and password. SSO arrives when the first customer’s security review requires it, and saying otherwise would be found out in the first one.
No penetration test has been carried out, and no uptime commitment is offered, because we do not yet monitor well enough to stand behind one.
Telling us about a problem
Write to security@procurepro.app. If you have found something, you will get a human reply, we will not argue about whether it counts, and we will tell you when it is fixed.