Security

1. Data Protection

• Encryption in transit: All connections to the Service use TLS
• Encryption at rest: The database (PostgreSQL, hosted by Supabase) is encrypted at rest
• Token encryption: OAuth tokens for connected services (e.g. Google Sheets) are encrypted with AES-256-GCM before being written to the database; encryption keys exist only on our servers
• Access controls: Row Level Security (RLS) and permission-checked database functions restrict access to owned records and explicitly shared project data. Organisation collaborators receive the project roles granted to them.

2. Data Minimisation

• Selected email extraction: The Gmail extension and Outlook add-in process the message you choose to extract. Current extraction routes save structured results rather than the raw email body.
• No PDF text retention: Text extracted from PDF uploads is processed in memory and not stored
• Upload source handling: Current Excel, CSV and Word extraction routes save structured fields without retaining the source text. Older records may still contain raw source.
• Separate workflow records: Comparison results include selected quote fields and source excerpts. RFQ drafts, customer replies, evaluations and imported delivery-failure reports are stored when you use those features. Extraction source minimisation does not delete those records.
• Private failure evidence: Imported delivery-failure email files are encrypted before storage. Source access is restricted to the original sender with current project access; shared history contains metadata rather than the raw file.
• Card handling: Stripe handles card entry. We store billing identifiers and subscription information, not your card number or CVV.

3. Authentication & Integrations

• Account sign-in: Email/password and Google sign-in use Supabase authentication. We do not receive your Google or Microsoft account password when you connect those services.
• Revocable integrations: Google Sheets and Microsoft 365 connections use OAuth. Disconnect them in Settings or revoke permissions with the provider. Google Sheets uses access to files you select or create; the Gmail extension does not request Gmail API access.
• Client sessions: The Chrome extension restricts credential storage to trusted extension contexts, with an access token in session storage and refresh token in local storage. The Outlook add-in uses host local storage where available, with an in-memory fallback. Client operations check their initiating account and selected source; changing accounts invalidates local recovery. The extension never holds connected-service tokens such as Google Sheets tokens.
• Explicit file recovery: Supported keyed file requests reuse an account-scoped attempt. Current authentication and plan checks still apply. Retry records retain processing evidence and a saved-result link, without storing a duplicate file. They do not guarantee recovery after every interruption.
• Server-side validation: Every protected API route validates authentication server-side

4. API & Application Protections

• Hashed API keys: API key verification uses stored SHA-256 hashes. Copy a newly created key to a secure location; the full key cannot be retrieved later.
• Signed webhooks: Inbound webhooks (e.g. Stripe) are signature-verified before any event is processed
• Request limits: Extraction and comparison endpoints enforce usage, input-size and rate limits.
• Security headers: Content Security Policy and other browser protections are configured by route. Office add-in routes allow the dependencies required by the Office runtime.
• AI output checks: Structured-output and source-reference checks help reject invalid results. These checks do not establish factual accuracy; review extracted information and comparisons against your source documents.
• Content safety: Required screening runs before extraction quota and ordinary AI processing. Images use independent AWS screening before OpenAI moderation. If a required check is unavailable, processing stops. PDF pages that may be sent to vision models are screened before generation begins. Document safety checks are bounded and may reject files that cannot be checked within processing limits.
• Restricted review: Safety incidents retain metadata rather than blocked content. Account restrictions and reviews are audited. Provider notices require signed webhooks and a separate case lookup. A pseudonymous identifier links OpenAI generation to the initiating account. These controls do not guarantee detection of every harmful submission and are not a dedicated child-abuse-material identification system.

5. Monitoring & Operations

• Error monitoring: Server monitoring supports security and troubleshooting. Optional browser error reports require diagnostics consent; browser replay and performance tracing are disabled. Reports can contain error messages, stack traces, routes and technical context; server records can include account identifiers. See the Privacy Policy for details.
• Background processing: Scheduled job endpoints use server-side authentication and record run status. Comparison requests persist their status so you can check an existing request after navigation or interruption.
• Server credentials: Provider secrets and encryption keys are configured on the server; public client configuration is kept separate.

6. Your Controls

• Account deletion: Settings → "Delete my account" removes your account and owned records. Shared RFQ and award history in another owner's project may remain with deleted actor references. Content snapshots and copies held by collaborators or external providers are separate; see the Privacy Policy.
• Manual raw-source retention: Preview eligible stored raw text, place holds and explicitly confirm a purge. Structured records, spreadsheet copies and backups are separate. Automatic deletion is off.
• Export: Download extraction data as CSV or Excel and use the available comparison and evaluation evidence downloads.
• Shared governance: Organisation capabilities and project roles are checked separately. Administrative exports require current access. Removing permission prevents later reads but cannot recall copies already downloaded. Purchase-order and proposal workflows require their own review and confirmation.
• Revoke access: Disconnect Google Sheets or Microsoft 365 in Settings and manage permissions with the provider. Disconnecting does not remove rows or messages already sent.

7. Responsible Disclosure

We welcome good-faith security research. If you believe you have found a vulnerability, please email support@procuremind.io with the subject line [SECURITY] and a description of the issue, affected component, and reproduction steps.

• We acknowledge reports within 48 hours and triage within 5 business days
• Please do not disclose the issue publicly before we have had a reasonable opportunity to investigate and fix it
• We do not pursue legal action against researchers who report promptly, in good faith, and without accessing other users' data
• We do not currently run a paid bug bounty programme; we offer acknowledgement and credit in our changelog

8. A Note on Certifications

ProcureMind has not undergone SOC 2, ISO 27001, or similar third-party certification, and we do not claim otherwise. The controls described above are the ones implemented in our code and infrastructure today. Questions about our security posture are welcome at support@procuremind.io. For privacy-related matters, see our Privacy Policy.