Account-scoped access
Evidence, credentials, monitoring and webhook records are queried by the authenticated account identifier.
SECURITY & TRUST CENTRE
Trust starts with accurate security claims.
CompanyProof is in private beta. This page separates controls present in the deployed architecture from the operational, legal and assurance work still required before general availability.
CURRENT PRODUCT STAGEPrivate beta
No SOC 2, ISO 27001 or penetration-test badge is claimed on this site unless and until the relevant assurance has been completed and can be evidenced.
Transparent statusUpdated 24 August 2026
DEPLOYED CONTROLS
Controls present in the current architecture.
These are narrow implementation statements, not a claim that private beta is ready for every enterprise security review.
One-way API-key storage
CompanyProof API keys are displayed once, stored as SHA-256 hashes and can be revoked independently.
Encrypted webhook secrets
Endpoint secrets are encrypted with AES-GCM at rest and are never displayed again after creation.
Signed outbound events
Webhook payloads use HMAC-SHA256 signatures, replay identifiers, bounded retries, redirect rejection and delivery history.
Service-secret isolation
Company-data and Stripe credentials are read only by server-side code and are never sent to the browser.
Durable abuse controls
Public data workflows and sensitive account actions have persistent rate limits, payload limits and strict input validation.
Atomic proof persistence
A proof, its claims, decision events and usage event are committed as one database batch or rolled back together.
Security activity history
Credential, webhook, monitoring and billing actions are recorded with actor, time and a shortened network hash.
Browser protections
Responses set anti-framing, content-type, referrer, permissions, HSTS and sensitive-page cache controls.
Verified Stripe events
Billing entitlements change only after Stripe signature verification and replay-safe event processing.
DATA HANDLING MODEL
Keep secrets out of the browser and minimise what enters the workflow.
A verification request contains a company identity and the claims or answer to verify. Customer and service credentials remain server-side. The proof and evidence record are stored under the authenticated account.
Sends company identity and claims using a revocable CompanyProof key.
Validates limits, resolves the entity and obtains the selected company evidence.
Atomically stores the proof, claim events, source context and monitoring state.
REQUIRED BEFORE GENERAL AVAILABILITY
The production security gate.
These controls are requirements, not completed-certification claims. Enterprise production contracts should not begin until the applicable controls have been implemented and verified.
Production identity activation
Activate WorkOS Google, Microsoft, Apple, passkey and SSO sign-in and verify the custom-domain callback configuration.
Multi-user organisations
Add invitations, role-based permissions, owner transfer and administrative separation of duties.
Backup restoration tests
Document backup coverage, run restoration exercises and evidence recovery objectives.
Central security monitoring
Route structured security events to alerting and define ownership for anomalous activity.
Strict script policy
Move from baseline CSP navigation controls to nonce- or hash-based script restrictions after analytics integrations are final.
Retention and deletion
Contractual retention controls and verified deletion workflows.
Incident response
Documented escalation, notification, recovery and post-incident review.
Independent assurance
Complete a penetration test and claim certifications only after the applicable assessment is formally complete.
Legal security pack
Approve the DPA, subprocessor register, service schedule and security architecture summary.
PROCUREMENT DOCUMENTATION
What an enterprise buyer should receive.
START THE SECURITY REVIEW EARLY