Security and your data

Audit evidence is sensitive. Here is how Proofroom keeps yours apart and in your hands.

On your own server

Proofroom runs on a server you control, with its own application and database. Your evidence never leaves your server: we never see it. The daily licence check sends us only your licence and installation IDs, the version and how many people use it.

Encrypted evidence

Evidence files are encrypted at rest with AES-256-GCM, under a key that belongs to your installation.

Your sign-in

Sign in through your own identity provider with OpenID Connect, or with local accounts that require two-factor authentication. Groups in your provider decide who is an admin, analyst, auditor or employee.

Your data, any time

Export everything whenever you like: an Excel workbook of every record and a ZIP of the evidence files, readable without Proofroom. The same export can be imported into a new Proofroom.

A record of every change

Sign-ins, reviews, changes to controls and settings: each is written to an audit log that cannot be edited from the application.