Tamper-evident history
Changes are recorded in a hash-chained audit trail.
Controls and evidence
Scope
A decision record is useful only if its content and history can be verified. The controls below are in place and are checked automatically.
Evidence
Tamper-evident history. Every operation that changes data writes an audit record, and an automated check on every release confirms that none is missing. Records are hash-chained and sealed nightly, so an alteration can be detected against an earlier seal.
Access to the audit trail. Organisation activity, the history of a log and the history of a single decision can be viewed. An evidence bundle can be exported with a manifest and an integrity hash.
Time-limited auditor access. Read access to evidence can be granted within a chosen scope. It expires on a set date and is revoked automatically.
Durability
Nightly backups, kept for 30 days in a separate bucket that only the backup job reads or writes. Each night’s run confirms that the previous backup completed, so a failed backup is detected within a day.
Attachment scanning. Uploads are scanned for malware before they can be downloaded. A file whose scan result cannot be read is not served.
Assessments
OWASP ASVS 5.0 Level 2. All 253 Level 1 and Level 2 requirements assessed, and kept current as the product changes: 132 met, 31 provided by the cloud platform, 32 partial and 1 gap. The gap list is available on request.
CIS Google Cloud Foundation Benchmark. All 84 controls were assessed in August 2026, each with a recorded disposition, on the Google Cloud project prorso used at the time. The current project, in use since September 2026, has not yet been re-assessed.
Software bill of materials for every release. The application has two runtime dependencies in the browser and four in the backend, audited on every change and weekly.
Accessibility to WCAG 2.2 AA, tested automatically against two tiers of the product on every deployment.
Operations and review
Control registry. Each control lists its evidence, whether that evidence still resolves, and when a person last confirmed it. A reviewer must record a reason when flagging a control.
Measured audit coverage. Every deployed function is checked against a matrix of the functions that must write an audit event, so a missing audit event is reported as a finding.
Access review on request. A snapshot lists every organisation and log and who holds access to each. It is the list a breach notification would use, and it is run routinely, not only during an incident.
Erasure request register. Each request is assessed, carried out and answered, and each step is recorded. A reply is sent even when a request is refused, and a refusal states what would need to change.
Note
These are self-assessments, not third-party audits. The assessments are available on request.
Data location and subprocessors
Every third party that processes customer data is listed below. 30 days’ notice is given before a new one is added.
Google Cloud / Firebase
Database, file storage, backups and server code — European Union. Sign-in uses Firebase Authentication, a global Google service. The processor that hands email to SendGrid runs in the United States
OpenAI
AI drafting features — United States
Twilio SendGrid
Invitation and notification email — United States
Plausible Analytics
Cookie-less usage analytics — European Union
Google reCAPTCHA
Abuse prevention — United States
Data location. Decision logs, files and backups are stored in the European Union: the database in Google Cloud’s eur3 multi-region, files and backups in the EU multi-region, and server code in europe-west1 (Belgium).
Four kinds of data leave the EU, each listed above and covered by standard contractual clauses or the EU–US Data Privacy Framework: text sent to an AI feature, which goes to OpenAI; outgoing email, sent through Twilio SendGrid; the processor that passes that email to SendGrid, which runs in us-central1; and the browser signals that Google reCAPTCHA checks to prevent abuse.
Sign-in records are held by Firebase Authentication, a global Google service with no region setting, so they are not described as stored in the EU. No UK region or choice of region is offered. Customers with a residency requirement should raise it before subscribing.
AI features
Some features use OpenAI to draft or suggest content. Content is sent only when a person uses one of these features, not in the background.
Content is not used to train models. prorso uses OpenAI’s API under its standard commercial terms, which exclude API data from training. When an AI feature runs on an organisation’s or a person’s own OpenAI key, that account’s terms and settings apply instead.
OpenAI retains requests for up to 30 days for abuse monitoring, then deletes them. Deleting content in prorso does not shorten this period.
Audit records do not store the text of AI requests. They record that a request was made, from which feature, with which model, and whether it succeeded.
When log content is sent to an AI provider
Content in a decision log reaches OpenAI only when someone uses an AI feature on that log. The guide inside a log runs on the log’s own OpenAI key when it has one (the organisation’s, or on a Personal log the owner’s own when the owner uses it), and on prorso’s account when it does not. Every other AI feature in a log runs only on the organisation’s own account, or, in a person’s own Personal logs, on their own key; until one is connected, those features do not run. Whether an organisation has connected an account is shown in its settings.
Current limitations
The items most often asked about in an evaluation, with their current status. Some are not in place; others are in place with limits.
NoneSOC 2
No report, and none in progress. Preparing one would take an estimated 6 to 15 months from when a customer requires it.
NoneISO 27001
No certification.
Not yetPenetration test
Not yet conducted. The scope is written and ready for a vendor.
PartialMulti-factor authentication
Accounts that sign in with a password can add an authenticator app, and an organisation can require this of its members. It is not required for individual accounts. SMS codes and hardware keys are not supported.
PartialSingle sign-on
An organisation’s members can sign in through its identity provider over OIDC or SAML (Okta, Microsoft Entra ID, Google Workspace and others), and the organisation can require this on its verified domains. prorso configures each provider; setup is not self-serve. Signing out at the provider does not end an open prorso session.
PartialSCIM provisioning
An organisation’s identity provider (Okta, Microsoft Entra ID and others) can add and remove its people and groups through SCIM 2.0, using a token issued by an organisation administrator. A removal takes effect at the provider’s next sync. Signing out at the provider does not by itself end a prorso session.
NoneEU / UK data residency
Not offered as a commitment. Data is stored in the EU, but there is no UK region and no choice of region, and AI requests and email are processed in the United States.
Not yetTested recovery time
Backups run and are verified. One restore drill has been run, on 21 September 2026: a full backup was restored with every record matching, but on a small dataset. It confirms the procedure, not a recovery time, so no recovery-time figure is published.
PartialAlerting
Alerts go to one configured recipient, and the channel can be tested on demand. There is no on-call rotation, and alerts are not monitored outside working hours.
PartialIncident records
Security thresholds are documented, but there is no incident store, so an alert is not tracked as a routed record.
PartialCompliance monitoring
Eight of the nine panels in the system console use live data. The ninth, incidents, is specified but not built, and is shown as not built.
PartialControl attestation
Controls are reviewed and dated internally. No external party has attested to them.
About this list
Items that are in place with limits are marked “partial”, rather than counted as present or absent.
Documents
Published
On request
Data Processing Agreement, with standard contractual clauses and a transfer impact assessment. A draft, available for review but not yet offered for signature.
Subprocessor register, the versioned source for the table above.
OWASP ASVS 5.0 Level 2 assessment, including the full gap list.
Accessibility Conformance Report covering WCAG 2.2, Section 508 and EN 301 549.
Software bill of materials for the current release.
Documents on request
The detailed assessment describes where a system is most exposed, so it is shared on request rather than published. Requests need no approval process and no NDA.
Reporting a vulnerability
Suspected security issues can be reported by email, with enough detail to reproduce them. Receipt is acknowledged, and the reporter is kept informed.
Testing must not involve other people’s data. Please allow reasonable time for a fix before any public disclosure.
Security questions and vulnerability reports
prorso is a personal project and is not affiliated with any organization. Security reports and due-diligence questions go directly to its developer.