Security and data protection

How your data is protected

• Every page and API request is served over HTTPS, so data is encrypted in transit.
• Stored data, including the database, backups and uploaded files, is encrypted at rest by our infrastructure providers.
• Passwords are never stored in readable form. ProtoPM keeps only a one-way hash made with an industry-standard algorithm.
• Uploaded project files are private. They open only for people on the project, through links that expire shortly after they are created.
• Card payments are handled by Stripe. ProtoPM never sees or stores full card numbers.

Access and accounts

• Role-based access: each person has a role on each project (owner, manager, member, viewer or guest) and sees only the projects they belong to.
• Company owners and admins can review an audit log of key changes.
• Optional two-step sign-in: turn on an emailed sign-in code in Settings, with single-use backup codes.
• Changing your password or email signs your account out on other devices.
• Repeated failed sign-in attempts are limited to stop password guessing.

Backups and recovery

• The database is backed up automatically, with point-in-time recovery, so it can be restored to a moment before a problem.
• Deleted projects stay in the Recycle bin for 30 days and can be restored with everything in them.
• You can keep your own copy too: back up and export your project data.

Certifications

ProtoPM does not hold its own SOC 2 or ISO 27001 report. The services that run ProtoPM, store its data and take payments are independently audited:

• Neon (database hosting): Annual SOC 2 and ISO 27001 audits; stored data encrypted at rest.
• Render (application hosting): SOC 2 Type 2 and ISO 27001.
• Stripe (payments): PCI Service Provider Level 1.

Your data stays yours

• You own the project and job data you enter (see the Terms of Service).
• Export any time: your account data as a JSON file from Settings, each project as a PDF or Excel workbook, and invoices as CSV for QuickBooks Online. Free includes 10 exports per company each month; the Documents & Branding add-on makes them unlimited.
• Delete your account from Settings whenever you want.
• Need a security questionnaire answered for a client or a bid? Contact us and we will help.
• The service providers that process your data are listed in the Privacy Policy.

Report a security issue

Found a security issue? Report it to [email protected] with the steps to reproduce it. We will confirm we received it and keep you updated.

Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data or disrupt the service while testing.

Questions