Security Trust

How ProveStack protects your records

Your SBOMs, incidents, findings and evidence describe weaknesses in your products and your organisation. This page states how ProveStack keeps them apart from other organisations and tamper-evident, and where its responsibility ends.

PilotProveStack is in a pilot phase. Pilots start with fictional or non-sensitive data.

01 Controls

What is enforced, and where

A dedicated instance per customer

Each customer runs on their own ProveStack instance, on an OVHcloud VPS in Europe, deployed and updated by us. No database, storage or process is shared with another customer. Active and standby instances in two data centres are in development.

one instance per customerOVHcloud, Europe

Tenant isolation in the database

Every table that holds organisation data has PostgreSQL row-level security enabled and forced. A query only sees rows of the organisation it runs for, even if application code has a bug.

PostgreSQL row-level securityevery tenant table

A database role that cannot bypass it

The API connects as a role that does not own the tables and cannot bypass row-level security. Schema migrations run separately, as the owner.

runtime role ≠ schema owner

Isolation in the application too

The application also scopes every read and write to the current organisation, so isolation never depends on a single layer.

database + application

Sign-in and roles

Sign-in uses OpenID Connect through Keycloak, with PKCE. Organisation membership and role are checked on the server for each request; the role is never taken from the token.

OpenID Connectserver-side memberships

Reviews pinned to exact evidence

A review applies to one exact evidence version. Nobody can approve evidence they submitted themselves, and a newer version needs a new review.

no self-approvalversion-pinned

Append-only journal

Material actions such as imports, triage decisions, reviews and closures are written to an append-only journal with actor and time. The journal is part of every evidence packet.

actoractiontimestamp

Request size limits

The API rejects oversized requests on the declared length and on the bytes actually received, before parsing them. SBOM and advisory uploads have their own limits.

enforced before parsing

Evidence packet integrity

Each evidence packet is frozen when exported and identified by the SHA-256 of its manifest; downloading it again gives identical bytes. A hash proves the bytes have not changed. It does not prove the content is true.

manifest SHA-256byte-identical re-download

This website

Served by Cloudflare Pages with a strict Content-Security-Policy, no analytics and no trackers; fonts are served from this site. The only cookie is the admin session. Contact messages are kept in Cloudflare D1 and deleted after 36 months.

no analyticsone admin cookie

02 Limits

What ProveStack does not do

ProveStack prepares the record. Decisions with legal weight stay with you, your counsel and the applicable conformity assessment.

No certificationProveStack does not certify products or organisations, issue SOC 2 reports or declare anything compliant. It prepares readiness and keeps evidence.
No CE markingCE marking follows the applicable conformity assessment. A dashboard cannot grant conformity.
No automatic legal conclusionsThe CRA check is a preliminary orientation. Applicability and reportability are decided by people.
No regulatory submissionReports are prepared here and submitted by a person through the ENISA Single Reporting Platform.
No scanningProveStack never scans your systems. Guided checks give you commands to run yourself on systems you own or are authorised to test. Declaring an asset does not authorise testing it.
No legal adviceObligation texts are paraphrases pending legal review. Confirm scope with qualified counsel.

Found a security issue?

Tell us through the contact page and we will coordinate the fix and disclosure with you. Please do not test against other people's data.