Security
Your data is encrypted. On your terms.
Every field is encrypted with AES-256 before it reaches our database. With Bring Your Own Key, you own the encryption key and control who can use it, including us.
AES-256
field-level encryption
Every sensitive field encrypted before it reaches the database. Per-tenant keys, isolated from data.
BYOK
bring your own key
Connect AWS KMS, Google KMS, or Azure Key Vault. Revoke your key and your data is permanently unreadable.
0 backdoors
by design
No impersonation mode. No view-as-tenant. No admin override. With BYOK, you control the key and can revoke our access at any time.
Scroll down to see exactly how it works, step by step.
Encryption at rest
Encrypted at rest. Decrypted only in memory.
Source
Your project management tool
BQE · Deltek · Productive · Harvest · Unanet
Encrypted at rest, decrypted on demand
ProLens compute
per-tenant keys
Your view
Dashboard
Margins · pacing · pulse
Sensitive fields are encrypted before they reach the database. Only the running application can decrypt them.
Source
Your project management tool
Productive · BQE · Deltek
Encrypted at rest, decrypted on demand
ProLens compute
per-tenant keys
Your view
Dashboard
Financial data is synced from your platform and encrypted at the field level before storage.
Client names, amounts, and team information are encrypted with your tenant's unique key.
Synced every 15 minutes. Each sync refreshes your data with the latest from your platform. Encrypted at rest between syncs. Permanently deleted when you disconnect.
All sensitive fields in our database appear as encrypted text, unreadable without the decryption key.
Disconnect ProLens and all your data, including encryption keys, is permanently deleted.
Bring your own key
You hold the key. Literally.
Every ProLens account can use its own encryption key via AWS KMS, Google Cloud KMS, or Azure Key Vault. Your key stays in your cloud account, backed by hardware security modules. ProLens has permission to use your key for encrypting and decrypting your data, but cannot copy, export, disable, or delete it. Every time your key is used, the event appears in your cloud provider's audit trail. Revoke our access and your data becomes permanently unreadable.
AWS KMS
Google Cloud KMS
Azure Key Vault
More providers coming soon
Prefer not to manage your own key? ProLens-managed encryption still protects every field with AES-256 per-tenant keys, isolated from the database.
Cost rate protection
Your cost rates are visible only to your application.
Cost rates and salary data are encrypted at the field level the moment they are synced. The raw values exist only in memory during margin calculations and are never stored in plaintext. Even in our database, cost rates appear as encrypted text that is unreadable without your tenant's decryption key.
What your platform has
- employee_name: Sarah Chen
- hourly_rate: $185
- cost_rate: $82
- salary_band: L4
What ProLens sees (in memory only)
- employee_name: Sarah Chen
- utilization: 87%
- project_margin: 34%
- ↳ discarded after compute
What ProLens stores
- name: aGVsbG8gd29y...
- cost_rate: UxZk9pq76ZV...
- margin: 9UWFK5Kqll...
- encrypted with your tenant key
AI anonymization
AI that never knows your name.
Every AI analysis runs on anonymized data. Before any information reaches our AI models, all client names, project names, and employee names are replaced with pseudonyms. The AI sees “Client Alpha” and “Project Bravo,” never your real names. De-anonymization happens server-side after the AI responds, so the named insights you see on your dashboard were never sent to any AI provider with identifying details.
Sent to AI provider
Dollar amounts, percentages, and dates are sent as-is so the analysis is accurate. Names are pseudonyms.
What you see on your dashboard
De-anonymized server-side, in your tenant. Never round-tripped through the AI provider with real names.
Connection security
Connect with OAuth. Disconnect with one click.
ProLens connects to your project management tool using OAuth. You authorize read-only access from your own account. Your credentials never pass through our servers. You can revoke access at any time from your platform settings or from ProLens with one click. When you disconnect, all your data is permanently deleted from our systems, including encrypted records, cache entries, and your encryption key.
We access
- Projects
- Invoices
- Time entries
- People
- Bookings
We do not access
- Documents
- File attachments
- Chat messages
- Passwords
For platforms without OAuth
API keys are encrypted with AES-256-GCM envelope encryption the moment you enter them. The decryption key exists only in our runtime environment, separate from the database. Your API key is decrypted in memory only during sync operations and is never stored in plaintext, never logged, and never accessible through any admin interface.
Audit trail
Every access, logged and visible to you.
ProLens logs every data access event: every sync, every AI analysis, every live view. This log is visible to you in your Settings > Security tab. You can see exactly when ProLens accessed your data, what it accessed, and whether it was an automated sync or a human-initiated action. Logs are retained for 90 days.
Settings > Security > Access Log
Last 24 hours
| Timestamp | Event | Resource | Initiated by |
|---|---|---|---|
| 2026-05-16 09:14:02 | Project sync | invoices, time_entries | automated · hourly |
| 2026-05-16 09:14:08 | Live view | margin_metrics | automated |
| 2026-05-16 08:47:31 | AI analysis | revenue_pulse (anonymized) | sarah.chen@firm.com |
| 2026-05-16 08:12:09 | Dashboard load | project_summary | j.principal@firm.com |
| 2026-05-16 07:00:01 | Project sync | projects, deals | automated · daily |
No backdoor. By design.
Tenant isolation at every layer.
ProLens has no “view as tenant” feature. No admin backdoor. No impersonation mode. Our architecture enforces tenant isolation at every layer: authentication, encrypted per-tenant data keys, API routing, and strict per-firm boundaries. A ProLens engineer debugging an issue sees anonymized metadata and error logs, never your financial data.
If we ever need direct access for support, we require your explicit written permission, generate a time-limited token, and provide you a full access report when it ends.
No view-as-tenant
There is no UI or API path that lets a ProLens employee see your data as you see it.
Row-level isolation
Every query is scoped to your tenant ID before any data is read. Tenant boundaries are enforced at the database and application layer with no cross-tenant access paths.
Strict firm boundaries
Data from your firm can never appear in another firm's view. The boundary is enforced before any data is read.
Time-limited support tokens
Any direct access for support requires your written approval and produces a full access report.
With Bring Your Own Key enabled, every decryption of your data is logged in your cloud account's audit trail. You can revoke ProLens's access to your key at any time, instantly making your data unreadable.
Data usage
Your data is yours. Period.
ProLens will never share, sell, or expose your firm's individual data to any third party or other ProLens customer. We may produce anonymized, aggregated benchmarks only when strict conditions are met.
What we will never do
- Share individual firm data with any third party
- Sell your data to other customers or data brokers
- Expose your data in another tenant's view
- Use your data to train AI models
What we may do
- Produce anonymized industry benchmarks across our network
- Only when the pool includes a minimum of 20 firms
- Only when no individual firm can be identified
- Opt out at any time in Settings
Compliance
Where we stand.
GDPR Compliant
All data encrypted at rest with per-tenant keys. Data processing agreement available on request.
SOC 2 Type I
In progress. Target: Q4 2026. Letter of intent available on request.
Encryption at Rest
AES-256-GCM field-level encryption for all sensitive data. BYOK available.
Read-Only Access
ProLens never writes to your project management tool.
Infrastructure
US-based hosting
Vercel + AWS us-east
TLS 1.3 in transit
All connections encrypted end-to-end
SOC 2 Type I
In progress. Letter of intent available.
GDPR-compliant architecture
Data processing agreement on request
Auto deletion on disconnect
All data and keys removed when you disconnect
Comprehensive audit logging
Every access event logged and visible to you
Role-based access control
Firm / Office / Studio / Team / My Projects scopes
Multi-factor authentication
MFA via Clerk on every account
FAQ
Security questions, answered directly.
All sensitive data is encrypted with per-tenant keys before storage. Direct database access reveals only ciphertext. With BYOK enabled, you can verify exactly when your key was used via your cloud provider's audit trail, and you can revoke ProLens's access at any time. Without BYOK, ProLens-managed encryption still protects every field with isolated per-tenant keys that are separate from the database.
Questions about security? security@prolens.ioPrivacy policy