Plain answers about your data.
What we store, where it lives, who can see it, and who helps us run the service. Security questions and reports go to security@proofsource.co, and a person replies.
The five questions we get most.
Where is my data stored?
In the United States, on Amazon Web Services.
Is it encrypted?
Yes, in transit and at rest. Credentials for tools you connect are encrypted again before they are stored.
Can other customers see it?
No. Each organization's data is kept separate in the database, and only members of your workspace can see it.
Do you change anything in my accounts?
Not without you. Google connections are read-only. A fix is published to WordPress only after you preview and confirm it.
Do you hold SOC 2 or ISO 27001?
Not today. We would rather say so than imply it. Ask us anything a questionnaire would.
How the service handles data.
What we store
What we store
Your account details, the brands you track (domain, competitors and questions), the AI answers we capture for them with their sources, and data from tools you choose to connect. Card and bank details are collected by our payment provider, not by us.
Encryption and isolation
Encryption and isolation
Traffic is encrypted in transit and data is encrypted at rest. Access tokens and keys for connected tools are sealed with AES-256-GCM before they are written to the database. Every organization's rows are isolated by row-level security in the database, so one workspace cannot read another's.
Read-only connections
Read-only connections
Search Console and Google Analytics ask Google for read-only scopes, one product per consent screen. Cloudflare reads analytics for the zone you pick. Disconnect any tool on the Integrations page and we delete our stored token.
Signing in
Signing in
You sign in with a one-time code sent to your email, or with Google. We do not store passwords.
This website
This website
Analytics on proofsource.co run without cookies until you accept them. Before you accept, we record only page views and a few named events, such as opening or sending the demo form. After you accept, we also record session replays, with everything typed into a form masked and the contact form left out. We do not use heatmaps or autocapture. That event carries the team size you pick, never your name, email or message. Each event reaches PostHog with your IP address and browser type.
Availability
Availability
A monitor outside the app checks the app, the API, scans and email every five minutes and publishes the result, 90 days of history and every incident on the status page. We aim for 99.5% a month for the app and the API. That is an internal target, not a contractual commitment; uptime terms are available in enterprise agreements on request.
Export and deletion
Export and deletion
To get a copy of your data, or to delete your account and everything in it, email privacy@proofsource.co. Tables in the app also export to CSV or JSON.
Who helps us run the service.
Each provider gets only what its job needs. We do not sell personal data or share it with advertisers.
| Provider | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Runs the app and its database, keeps backups, and runs some AI models through Amazon Bedrock. | United States (us-east-1). Amazon Bedrock may process an AI request in another AWS region through cross-region inference. |
| Cloudflare | Carries all traffic to the app and its API, and serves this website. | Worldwide edge network. |
| OpenAI | Answers your tracked prompts as ChatGPT, runs the assistant and content drafts, and transcribes cited videos. | United States. |
| Anthropic | Answers your tracked prompts as Claude, and is a backup for our analysis models. | United States. |
| Perplexity | Answers your tracked prompts as Perplexity. | United States. |
| Google Gemini | Answers your tracked prompts as Gemini, only on plans that add it. | Google data centers, worldwide. |
| Google Maps Platform | Reads your Google Maps listing when you start from a Google Maps link, and draws the maps in the app. | Google data centers, worldwide. |
| YouTube | Reads your YouTube channel when you start from a YouTube link, and finds channels you are compared with. | Google data centers, worldwide. |
| xAI | Answers your tracked prompts as Grok, only on plans that add it. | United States. |
| DeepSeek | Answers your tracked prompts as DeepSeek, only on plans that add it. It runs on Amazon Bedrock; DeepSeek's own API answers only when Bedrock fails. | United States on Amazon Bedrock. China when DeepSeek's own API answers. |
| TypeSafe | Grades captured answers with its Jev model: intent, claim accuracy and stance. | United States. |
| DataForSEO | Fetches Google AI Overviews, logged-out ChatGPT answers, search results and keyword volumes, and, when you start from an app or Google Maps link, app store listings and Google business listings for you and your competitors. | Estonia (EU) and Ukraine. |
| Firecrawl | Reads public web pages our own crawler cannot (cited pages, your site, competitor pages), takes screenshots of cited pages and your homepage, searches the web for new pages about your category, and watches competitor pages for changes. | United States. |
| TinyFish | Reads public web pages and Google AI Overviews in a real browser. | United States. |
| Xpoz | Searches public Reddit posts and comments that name your brand. | Not published by Xpoz. Its terms follow Israeli law. |
| Resend | Sends our emails: sign-in codes, results, alerts, and service and billing notices. | United States. |
| Knock | Delivers in-app notifications, and Slack notifications you set up. | United States. |
| Slack | Our own team's workspace: service alerts, and messages sent through our contact, demo and support forms. | United States. |
| Dodo Payments | Merchant of record: bills you and handles sales tax. Card and bank details go to Dodo Payments, not to us. | United States and other countries. |
| PostHog | Website analytics, including approximate visitor location, and anonymous quality counts from the app. | United States. |
The data each one receives is on the subprocessors page. Tools you connect, such as Google or your own Slack, receive data because you asked us to send it. Questions about this list go to privacy@proofsource.co.
Found a vulnerability? Tell us first.
Email security@proofsource.co with the steps to reproduce. Please do not access other customers' data, run denial-of-service tests or send us personal data you found. We reply, fix, and tell you when it is fixed.
Contacts
- Security reports and questions
- security@proofsource.co
- Privacy and data requests
- privacy@proofsource.co