Security and your data

Audit evidence is sensitive. Here is how Proofroom keeps yours apart and in your hands.

Your own stack

Each client gets a separate application and database. Nothing is shared with another client's workspace.

Encrypted evidence

Evidence files are encrypted at rest with AES-256-GCM, under a key that belongs to your installation.

Your sign-in

Sign in through your own identity provider with OpenID Connect, or with local accounts that require two-factor authentication. Groups in your provider decide who is an admin, analyst, auditor or employee.

Your data, any time

Export everything whenever you like: an Excel workbook of every record and a ZIP of the evidence files, readable without Proofroom. The same export can be imported into a new Proofroom.

A record of every change

Sign-ins, reviews, changes to controls and settings: each is written to an audit log that cannot be edited from the application.