Security

1. Data Protection

• Encryption in transit: All connections to the Service use TLS
• Encryption at rest: The database (PostgreSQL, hosted by Supabase) is encrypted at rest
• Token encryption: OAuth tokens for connected services (e.g. Google Sheets) are encrypted with AES-256-GCM before being written to the database; encryption keys exist only on our servers
• Tenant isolation: Row Level Security (RLS) is enabled on the tables that store your data, so one user can never read or write another user's rows the rule is enforced by the database itself, not just by application code

2. Data Minimisation

• No raw email retention: Email bodies are read only when you click "Extract RFQ", processed, and never written to our database only the structured extraction result is saved
• No PDF text retention: Text extracted from PDF uploads is processed in memory and not stored
• Limited spreadsheet retention: Text extracted from Excel/CSV uploads is retained with the extraction record so you can review it; you can permanently purge it from your dashboard at any time
• No card data: Payment details are handled entirely by Stripe and never touch our servers

3. Authentication & Integrations

• OAuth-only sign-in: You sign in with Google OAuth we never see or store your Google password
• Revocable integrations: Third-party connections (Google Sheets) use OAuth and can be revoked at any time from your Google Account settings or our Settings page
• Extension credential split: The Chrome Extension stores only your ProcureMind session the short-lived access token in session storage (cleared when the browser closes), the refresh token in Chrome's extension-isolated local storage. It never holds tokens for connected services such as Google Sheets
• Server-side validation: Every protected API route validates authentication server-side

4. API & Application Protections

• Hashed API keys: API keys are stored only as SHA-256 hashes the raw key is never persisted
• Signed webhooks: Inbound webhooks (e.g. Stripe) are signature-verified before any event is processed
• Rate limiting: API routes are rate-limited to deter abuse and brute-force attempts
• Security headers: A strict Content-Security-Policy and browser isolation headers are applied, with a dedicated CSP violation reporting endpoint
• AI input hygiene: Inputs to AI routes are sanitised and screened for prompt-injection patterns before processing

5. Monitoring & Operations

• Error monitoring: Application errors are tracked via Sentry; error reports do not include email content
• Background processing: Scheduled work (e.g. quote follow-ups) runs through our own secured cron routes, triggered by GitHub Actions on a fixed schedule, with no third-party job processor
• Credentials in environment variables: Secrets are never committed to source control

6. Your Controls

• Account deletion: Settings → "Delete my data" permanently deletes your account; deletion cascades across your quotes, customers, messages, extractions, and usage logs
• Raw text purge: Purge retained Excel/CSV extraction text from your dashboard at any time
• Export: Download your extraction history as CSV
• Revoke access: Disconnect Google Sheets or revoke Google OAuth whenever you choose

7. Responsible Disclosure

We welcome good-faith security research. If you believe you have found a vulnerability, please email support@procuremind.io with the subject line [SECURITY] and a description of the issue, affected component, and reproduction steps.

• We acknowledge reports within 48 hours and triage within 5 business days
• Please do not disclose the issue publicly before we have had a reasonable opportunity to investigate and fix it
• We do not pursue legal action against researchers who report promptly, in good faith, and without accessing other users' data
• We do not currently run a paid bug bounty programme; we offer acknowledgement and credit in our changelog

8. A Note on Certifications

ProcureMind.io has not undergone SOC 2, ISO 27001, or similar third-party certification, and we do not claim otherwise. The controls described above are the ones implemented in our code and infrastructure today. Questions about our security posture are welcome at support@procuremind.io. For privacy-related matters, see our Privacy Policy.