Security Practices

Our security program is founded on the principle of data minimization and defense-in-depth.

• Hash-Only Architecture: We never process or store raw customer data payloads. Our entire system operates exclusively on SHA-256 cryptographic hashes.
• Signed Bundles: All proof metadata is cryptographically signed using the Ed25519 signature algorithm to ensure authenticity and integrity.
• Key Management: Signing keys are managed with strict access controls and a regular rotation policy. Enterprise plans offer integration with customer-managed KMS.
• Least-Privilege Access: Internal access to production systems is restricted to authorized personnel on a need-to-know basis, protected by multi-factor authentication.
• Change Management: All changes to our production environment undergo a formal review and approval process, including automated testing and peer review.

Data Handling

We are transparent about the data we handle and how we manage it.

• What We Store: We store cryptographic hashes, Merkle proof paths, timestamps, and minimal, non-sensitive metadata required for proof construction.
• What We Never Store: We never store raw customer event payloads, personally identifiable information (PII), or any other sensitive data from your systems.
• Retention: Proof metadata is retained according to the customer's subscription plan. Standard plans offer operational retention, while Enterprise plans allow for configurable long-term archival (up to 10 years).
• Deletion: Data is permanently deleted from our systems upon the expiration of the retention period or upon customer request, in accordance with our terms of service.

Compliance & Attestations

We continuously evaluate our controls against industry-standard frameworks. Our current compliance status is as follows:

• SOC 2 Type II: In progress. A report will be available on request for customers under NDA upon completion.
• GDPR & CCPA: Our data minimization practices align with the core principles of privacy regulations. As we do not process personal data, our role is typically that of a processor's sub-processor with limited scope.

To request compliance artifacts, please contact your account representative or email security@proofbeam.com.

Availability & Status

We are committed to providing a reliable and available service. Real-time and historical uptime information for all our services is available at our public status page: status.proofbeam.com.

Responsible Disclosure

We value the work of independent security researchers and have a policy to encourage the responsible reporting of security vulnerabilities.

• Reporting: Please report potential vulnerabilities to security@proofbeam.com.
• Policy: We adhere to a 90-day disclosure timeline and will work with you to validate and remediate any identified issues. We do not currently offer a public bug bounty program.
• Encryption: You may use our PGP key (available upon request) to encrypt your communications with us.

Shared Responsibility

Security is a shared responsibility. While Proofbeam is responsible for the security of our infrastructure and services, customers are responsible for:

• Identity & Access Management: Securely managing user accounts, API keys, and access credentials for your Proofbeam account.
• Input Correctness: Ensuring the integrity and correctness of the event data hashed and submitted to our service.
• Client-Side Security: Securing the environments from which your applications interact with the Proofbeam API.