Trust Center
How Proviso protects the contracts you send us, and the audits that check it.
We never train models on customer documents
Your agreements are used only to run your own reviews. They are not used to train or improve any model, ours or a provider’s, and every model provider we use is bound to the same terms in writing.
Security controls
What we do in each area. The SOC 2 report sets out how each control was tested.
Encryption
AES-256 at rest and TLS 1.2 or higher in transit. Enterprise workspaces can bring their own keys.
Access
Single sign-on with SAML, SCIM provisioning and permissions per matter. Staff access to customer data needs an approved ticket and is logged.
Infrastructure
Hosted on AWS in the region you choose, with production separated from every other environment and no public access to databases.
Application security
Code review on every change, dependency scanning, and a penetration test by an outside firm every year.
Monitoring and response
Logs kept for a year, an engineer on call around the clock, and customers told of a confirmed incident within 48 hours.
Backups and recovery
Backups every hour, kept for 35 days, and a restore tested every quarter.
Subprocessors
We give customers 30 days’ notice before adding one.
Amazon Web Services
Hosting, storage and language models through Amazon Bedrock, with no data retained
Cloudflare
Network and attack protection
Datadog
Monitoring and logs
Zendesk
Support requests
Data regions
You choose a region when your workspace is created. Sign-in follows it.
US
United States
Virginia. Documents, reviews and backups stay in the United States.
EU
European Union
Frankfurt. Nothing leaves the EU, including support access.
UK
United Kingdom
London. Data stays in the UK under UK GDPR.
Policy documents
Request our security documents
We share reports and policies under NDA, usually within one business day. Customers can download them from Settings in their workspace.