Docs

Guides for installing and running Proofroom on your own server. They are the same guides that ship with each release.

• Install Proofroom

  One command on your own Linux server, about 10 minutes. What you need, what the script does, and the settings for single sign-on and email.

• Running Proofroom

  The full guide for whoever runs the server: updates, backups and copying them off the server, restoring, moving to a new server, and troubleshooting. Written for your IT team or the partner who runs Proofroom for you.

• Command reference

  Every proofroomctl command and install.sh option: what it does, the options and their defaults, exit codes and examples, and simulate mode (-s), which prints what a command would change without changing it.

• Setting up Proofroom with an agent

  For an AI agent setting Proofroom up for a client, and the person supervising it: install without prompts, licence, sign-in, email, integrations, frameworks, checking it worked, connecting through MCP, and what the agent never does.

• AI assistants (MCP)

  Let people ask the AI assistant they already use about their compliance work. Turning it on, approving clients, the tools, limits and revoking access.

• SBOM and vulnerability scanning

  What is in each release, the scan every release and build passes before it is published, and how findings are handled.

• ISO 27001 in Proofroom

  ISO/IEC 27001:2022 in Proofroom: the clauses and Annex A in our own words, the Statement of Applicability, the yearly ISMS work as Workflow checks, and the certification audits from stage 1 to recertification.

• Release notes

  Each release and what to do when you update. Your Proofroom's Admin → Updates links to the release it offers.

Integrations

Connecting Proofroom to the systems it collects evidence from, and to your directory of people. The help links in the app open these guides.

• Directory sources

  Where Proofroom's list of people comes from: SCIM from your identity provider, a CSV file, or Microsoft Graph. How to set up each one, and how fresh the list must be.

• Asset inventory

  Proofroom files the list on its Assets page as monthly evidence:

• AWS

  The AWS connector reads one AWS account and files three snapshot evidence items.

• Azure

  Proofroom reads Azure with an app registration (a service principal) that has read-only roles, and files three kinds of evidence per run across the subscriptions you choose.

• Azure DevOps

  Proofroom reads Azure DevOps (REST API 7.1) as an Entra app registration with the client-credentials flow and files five kinds of evidence.

• Bitbucket

  Proofroom reads one Bitbucket Cloud workspace and files three kinds of evidence.

• Certn

  The Certn connector files evidence that new joiners were background-checked.

• Confluence

  Proofroom reads policy pages kept in Confluence Cloud with a read-only API token:

• CrowdStrike Falcon

  Proofroom reads CrowdStrike Falcon with a Falcon API client's read scopes.

• GitHub

  Proofroom reads one GitHub organisation with a read-only fine-grained personal access token and files four kinds of evidence.

• GitLab

  Proofroom reads one GitLab group (and its subgroups' projects) with a read_api token and files three kinds of evidence.

• Google Cloud

  Proofroom reads Google Cloud as a service account with read-only roles and files three kinds of evidence, for the projects you list or every active project it can find.

• Google Drive

  Proofroom reads policy documents kept in Google Drive with a service account that can only read:

• Google endpoint management

  Proofroom reads the devices Google manages or sees through the Cloud Identity Devices API, as a service account acting for an administrator through domain-wide delegation.

• Google Workspace

  Proofroom reads Google Workspace's Admin SDK as a service account that acts for one of your administrators through domain-wide delegation, with read-only scopes, and files five kinds of evidence.

• iManage

  iManage Work's API reference is open only to iManage customers and partners, so Proofroom reads its policies by export:

• Iru (formerly Kandji)

  Proofroom reads Iru (formerly Kandji) through the Iru Endpoint Management API with an API token.

• Jamf Pro

  Proofroom reads Jamf Pro through the Jamf Pro API with an API client (client credentials).

• Jira

  Proofroom reads three kinds of evidence from Jira Cloud or Jira Data Center (8.14 or later), each filed once per period as one evidence item with a summary and the full records as JSON.

• JumpCloud

  Proofroom reads JumpCloud with an administrator's API key and files four kinds of evidence.

• Linear

  Proofroom reads Linear's API with a read-only API key and files two kinds of evidence.

• Microsoft Defender for Endpoint

  Proofroom reads Defender for Endpoint with an app registration's application permissions:

• Microsoft Entra ID

  Proofroom reads Microsoft Entra ID through Microsoft Graph with an app registration's application permissions, and files six kinds of evidence.

• Microsoft Intune

  Proofroom reads Microsoft Intune through Microsoft Graph with an app registration's application permissions.

• Okta

  Proofroom reads Okta's Management API with a read-only credential and files five kinds of evidence.

• OneLogin

  Proofroom reads OneLogin's API with an API credential and files four kinds of evidence.

• Opsgenie (and Jira Service Management operations)

  Proofroom reads on-call schedules and incidents from Opsgenie, or, once your account has moved, from Jira Service Management operations.

• PagerDuty

  Proofroom reads PagerDuty's REST API with a read-only key.

• PolicyTech

  NAVEX PolicyTech publishes no read API Proofroom can use, so its policies come by export:

• Qualys

  Proofroom reads Qualys VMDR with a read-only API user.

• Rapid7

  Proofroom reads Rapid7 InsightVM through the Insight Platform's Cloud Integrations API (v4) with a user key.

• Scan imports

  Scan imports files vulnerability scans that Proofroom cannot read through an API:

• SentinelOne

  Proofroom reads SentinelOne with a service user's API token.

• ServiceNow

  Proofroom reads change requests with their approvals, and security incidents, through ServiceNow's Table API.

• SharePoint and OneDrive

  Proofroom reads policy files kept in SharePoint document libraries or OneDrive through Microsoft Graph, with an app registration that reads:

• Tenable

  Proofroom reads Tenable Vulnerability Management (cloud.tenable.com) with the API keys of a dedicated user.

• This Proofroom server

  Proofroom files your own server's patch report as monthly evidence.

• Zendesk

  Proofroom reads Zendesk Support with an API token of a dedicated integration user and files four kinds of evidence.

• Zenduty

  Proofroom reads Zenduty's REST API with an account API key and files four kinds of evidence.

• Manual systems and your own

  Most systems a company uses have no Proofroom connector yet.

Something missing or unclear? Write to hello@proofroom.com.