Security & Trust
ProvenanceOS is a provenance product — claim integrity is the point. Here is exactly how we protect your data and what we do (and don't) claim.
The short version: Source content may be processed transiently to compute provenance signals and is never retained — there is no stored repository mirror. There is no stored copy of your repository for an attacker to take.
We never store your source code
Source content may be processed transiently to compute provenance signals and is never retained — ProvenanceOS does not store a copy of your code. There is no repository mirror to breach.
Encrypted everywhere
All data is encrypted in transit with TLS 1.3, and encrypted at rest by our infrastructure providers (InsForge and Railway); at-rest keys are managed by the hosting layer, not by us. Secrets and credentials are stored in managed secret storage, never in source control.
Built to SOC 2 controls
The platform is engineered against SOC 2 Trust Services Criteria (security, availability, confidentiality). We have not engaged an independent auditor yet; we describe our posture honestly rather than claiming a certificate we do not hold.
Hardened web surface
Every response ships HSTS (preload), a strict Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a strict Referrer-Policy. Authentication routes are marked noindex.
Privacy by default
We honor Global Privacy Control (GPC) signals and load analytics only after an explicit consent decision, with granular cookie preferences. We collect the minimum needed to operate the service.
Least-privilege access
Production access is scoped and audited, and row-level security is enabled on the database. Per-tenant data isolation is being hardened ahead of general availability.
How ProvenanceOS processes your data
ProvenanceOS may process source content transiently to calculate provenance signals. Source files are not retained after processing, are not used to train models, and are not stored as a repository mirror. We retain only the account, job, repository metadata, derived signals, policy outcomes, and reports needed to provide the service.
| Data type | Processed | Retained | Retention | Third-party access |
|---|---|---|---|---|
| Source files[data-handling:Source files] | Yes, transiently. Archive uploads are SHA-256 hashed for integrity; source content is not stored as a repository mirror. | No | Deleted after job completion/failure window. Archive bytes are never persisted; only the hash is stored on the scan job. | No third-party access to source content. Processing runs in ProvenanceOS infrastructure. (Subprocessor list: see /security.) |
| Repository metadata[data-handling:Repository metadata] | Yes. Repository URL and provider are read to create a durable scan job. | Yes | Retained for the life of the account so job history is queryable. Deleted on account deletion. | Hosted on InsForge (managed Postgres). No source content is sent to third parties. |
| Derived signals[data-handling:Derived signals] | Yes. Provenance signals (AI-origin indicators, confidence scores, policy outcomes) are computed as each enabled capability completes. | Yes | Retained with the scan job so results remain queryable and exportable. Deleted with the job or on account deletion. | Stored in ProvenanceOS infrastructure (InsForge managed Postgres). Not shared with third parties. |
| Reports[data-handling:Reports] | Yes. Audit-ready compliance and provenance reports will be generated from derived signals when report generation ships (planned). | Yes | Customer-controlled. You can delete a report at any time; export retains your copy. Deleted on account deletion. | Only when you explicitly export or share a report. No automatic third-party access. |
| Credentials/tokens[data-handling:Credentials/tokens] | No. Repository analysis currently fetches public repository URLs unauthenticated; no repository-provider credentials or tokens are collected. | No | Not applicable. No repository-provider credentials or tokens are collected or stored. | None. No repository-provider credentials or tokens exist to share with third parties. |
Retention windows are scoped per plan and finalized at GA.
Trust Center
This Trust Center index maps each procurement artifact a security reviewer expects to its current status. Items marked Published are fetchable today; items marked Available under NDA are shared with design partners under a mutual NDA; items marked In progress are being drafted for general availability; items marked Not applicable are intentionally out of scope for the current product stage.
- Published
System architecture diagram[trust-center:system-architecture]
High-level architecture of the scan intake, queued-job, and worker pipeline. The /pricing proof stack renders the architecture/data-flow diagram a buyer sees before the ask.
View artifact - Published
Data-flow diagram[trust-center:data-flow]
How source files, repository metadata, derived signals, and reports move through the platform. The data-processing table on /security is the canonical data-flow reference.
View artifact - Published
Data retention + deletion policy[trust-center:data-retention-deletion]
Retention windows per data type (source files, metadata, signals, reports, credentials). Source content is not retained; metadata is retained for the life of the account.
View artifact - In progress
Subprocessor list[trust-center:subprocessors]
Third parties that process customer data on ProvenanceOS's behalf (hosting, database, secrets). The current list includes InsForge (managed Postgres) and the customer's chosen repository provider for metadata reads.
- In progress
Regional hosting / data residency[trust-center:data-residency]
Current hosting region and available data-residency options. ProvenanceOS runs on Railway + InsForge today; multi-region data residency is not yet available.
- In progress
Backup + disaster-recovery summary[trust-center:backup-dr]
Backup cadence, retention, restore objectives, and DR topology. Managed-Postgres backups are provided by the hosting layer; a formal DR runbook is in progress.
- Available under NDA
Incident-response policy[trust-center:incident-response]
Detection, triage, customer-notification, and post-incident review process. A formal IR policy is being drafted for the early-access engagement; available under NDA for design partners.
- Published
Access-control model[trust-center:access-control]
Role-based access, row-level security on tenant data, least-privilege production access, and scoped/audited database access. Production access is scoped and audited; row-level security is enabled on the database, with per-tenant isolation still being hardened.
View artifact - In progress
Vulnerability-management policy[trust-center:vulnerability-management]
Dependency scanning, CVE triage cadence, and remediation SLAs. ProvenanceOS uses its own dependency + OSV.dev matching; a formal vulnerability-management policy is in progress.
- In progress
Penetration-test status[trust-center:penetration-test]
Independent penetration-test cadence and the most recent report. No independent penetration test has been completed yet for the pre-revenue early-access product; a first engagement is scheduled as the product reaches GA.
- In progress
Secure development lifecycle[trust-center:secure-sdlc]
Code review, secret scanning, CI gates, and signed-commit practices. Secure-development practices are in place (typecheck, unit tests, claim-integrity cypress gates); a formal SDL document is in progress.
- Available under NDA
Encryption key-management summary[trust-center:key-management]
At-rest and in-transit (TLS 1.3) encryption, plus how secrets and credentials are stored in managed secret storage. Keys are managed by the hosting layer; a customer-managed-key option is not yet available.
- Published
Responsible disclosure / security.txt[trust-center:responsible-disclosure]
Machine-readable responsible-disclosure policy at /.well-known/security.txt. Reports go to support@provenance-os.com with a reasonable remediation window before public disclosure.
View artifact - Available under NDA
DPA request flow[trust-center:dpa-request]
How to request a Data Processing Agreement. Design partners can request a DPA through /contact; a standard DPA template is available under NDA.
- Available under NDA
Security questionnaire request[trust-center:security-questionnaire]
How to submit a vendor security questionnaire (CAIQ, SIG, custom). Design partners can request the questionnaire response through /contact; a response is provided under NDA.
- In progress
Compliance status with dates + evidence[trust-center:compliance-status]
SOC 2 readiness (built to SOC 2 controls; independent audit not yet started). Independent attestation is not yet held; the product is described honestly as 'SOC 2 Ready' rather than 'SOC 2 Certified'.
- In progress
Status page[trust-center:status-page]
A public status page with uptime + incident history. A dedicated status page is not yet published; early-access incident communication goes to design partners directly.
Claims registry
Every compliance, security, and privacy claim on this site is registered here with the server source behind it and the date it is next due for re-review. The [claim-id] citations in the tables above link to the matching entry. Nothing in this list asserts a certificate we do not hold — where an artifact is pending, the claim says so.
[data-handling:Source files]Owner: engineering · Next review: 2027-07-11Source files — not retained.
Evidence: src/config/data-processing.ts (dataProcessingRows)
[data-handling:Repository metadata]Owner: engineering · Next review: 2027-07-11Repository metadata — retained.
Evidence: src/config/data-processing.ts (dataProcessingRows)
[data-handling:Derived signals]Owner: engineering · Next review: 2027-07-11Derived signals — retained.
Evidence: src/config/data-processing.ts (dataProcessingRows)
[data-handling:Reports]Owner: engineering · Next review: 2027-07-11Reports — retained.
Evidence: src/config/data-processing.ts (dataProcessingRows)
[data-handling:Credentials/tokens]Owner: engineering · Next review: 2027-07-11Credentials/tokens — not retained.
Evidence: src/config/data-processing.ts (dataProcessingRows)
[trust-center:system-architecture]Owner: engineering · Next review: 2027-07-11System architecture diagram — Published.
Evidence: src/config/trust-center.ts + published artifact at /pricing#proof-stack
[trust-center:data-flow]Owner: engineering · Next review: 2027-07-11Data-flow diagram — Published.
Evidence: src/config/trust-center.ts + published artifact at /security#data-processing
[trust-center:data-retention-deletion]Owner: engineering · Next review: 2027-07-11Data retention + deletion policy — Published.
Evidence: src/config/trust-center.ts + published artifact at /security#data-processing
[trust-center:subprocessors]Owner: operator · Next review: 2027-07-11Subprocessor list — In progress.
Evidence: src/config/trust-center.ts
[trust-center:data-residency]Owner: operator · Next review: 2027-07-11Regional hosting / data residency — In progress.
Evidence: src/config/trust-center.ts
[trust-center:backup-dr]Owner: operator · Next review: 2027-07-11Backup + disaster-recovery summary — In progress.
Evidence: src/config/trust-center.ts
[trust-center:incident-response]Owner: operator · Next review: 2027-07-11Incident-response policy — Available under NDA.
Evidence: src/config/trust-center.ts
[trust-center:access-control]Owner: engineering · Next review: 2027-07-11Access-control model — Published.
Evidence: src/config/trust-center.ts + published artifact at /security
[trust-center:vulnerability-management]Owner: operator · Next review: 2027-07-11Vulnerability-management policy — In progress.
Evidence: src/config/trust-center.ts
[trust-center:penetration-test]Owner: operator · Next review: 2027-07-11Penetration-test status — In progress.
Evidence: src/config/trust-center.ts
[trust-center:secure-sdlc]Owner: operator · Next review: 2027-07-11Secure development lifecycle — In progress.
Evidence: src/config/trust-center.ts
[trust-center:key-management]Owner: operator · Next review: 2027-07-11Encryption key-management summary — Available under NDA.
Evidence: src/config/trust-center.ts
[trust-center:responsible-disclosure]Owner: engineering · Next review: 2027-07-11Responsible disclosure / security.txt — Published.
Evidence: src/config/trust-center.ts + published artifact at /.well-known/security.txt
[trust-center:dpa-request]Owner: operator · Next review: 2027-07-11DPA request flow — Available under NDA.
Evidence: src/config/trust-center.ts
[trust-center:security-questionnaire]Owner: operator · Next review: 2027-07-11Security questionnaire request — Available under NDA.
Evidence: src/config/trust-center.ts
[trust-center:compliance-status]Owner: operator · Next review: 2027-07-11Compliance status with dates + evidence — In progress.
Evidence: src/config/trust-center.ts
[trust-center:status-page]Owner: operator · Next review: 2027-07-11Status page — In progress.
Evidence: src/config/trust-center.ts
[compliance:soc2]Owner: operator · Next review: 2027-07-11Built to SOC 2 controls — independent audit not yet started
Evidence: src/config/feature-availability.ts (compliance.soc2)
[security:encryption-at-rest]Owner: engineering · Next review: 2027-07-11Data is encrypted at rest by our infrastructure providers (InsForge/Railway); at-rest keys are managed by the hosting layer.
Evidence: src/app/(public)/security/page.tsx (principles) + src/config/trust-center.ts (key-management)
[security:encryption-in-transit]Owner: engineering · Next review: 2027-07-11Data is encrypted in transit with TLS 1.3.
Evidence: src/app/(public)/security/page.tsx (principles)
[data-handling:source-not-retained]Owner: engineering · Next review: 2027-07-11Source content may be processed transiently and is never retained — there is no stored repository mirror.
Evidence: src/config/data-processing.ts (dataProcessingIntro + Source files row)
[security:responsible-disclosure]Owner: engineering · Next review: 2027-07-11Responsible-disclosure policy published at /.well-known/security.txt.
Evidence: src/config/trust-center.ts (responsible-disclosure) + /.well-known/security.txt
[security:access-control]Owner: engineering · Next review: 2027-07-11Production access is scoped and audited; row-level security is enabled on the database, with per-tenant isolation still being hardened.
Evidence: src/config/trust-center.ts (access-control)
[marketing:kdp-cross-promo]Owner: operator · Next review: 2027-07-11Footer carries a restrained 'Built by Edward Brooks — author of the Imani series' line (POS-015 KDP cross-promo policy).
Evidence: src/components/layout/PublicFooter.tsx (POS-015)
[data-handling:retention]Owner: operator · Next review: 2027-07-11Retention windows per data type are documented in the data-processing table; exact windows to be confirmed at GA.
Evidence: src/config/data-processing.ts (retention column)
[data-handling:subprocessors]Owner: operator · Next review: 2027-07-11Subprocessors: InsForge (managed Postgres) + the customer's chosen repository provider for metadata reads. Full signed list pending.
Evidence: src/config/trust-center.ts (subprocessors) + src/config/data-processing.ts (thirdParty column)
[privacy:data-collection]Owner: legal · Next review: 2027-07-11We collect information you provide directly (name, email, company, billing, repository metadata — not source code).
Evidence: src/app/(public)/legal/privacy/page.tsx (§2 Information We Collect) + src/config/data-processing.ts
[privacy:encryption]Owner: engineering · Next review: 2027-07-11All data is encrypted at rest and in transit.
Evidence: src/app/(public)/legal/privacy/page.tsx (§4 Data Security) + src/app/(public)/security/page.tsx
Reporting a vulnerability
We welcome responsible disclosure. If you believe you have found a security issue, email support@provenance-os.com with details and reproduction steps. Please give us a reasonable window to remediate before any public disclosure. Our machine-readable policy is published at /.well-known/security.txt.
ProvenanceOS is built by Developer312. You reach the founder directly — there is no support tier between you and the person who maintains the platform.
Questions about security or a compliance review?
Contact us