Security & trust

1. Application security controls

The following describes controls implemented in the CompanyProof codebase. It is a technical summary, not an independent assessment, a promise that all incidents can be prevented or a substitute for your agreed service schedule.

2. Data handling and minimisation

A company-verification request contains the identity and supported claims needed for the check. AI-assisted text verification sends relevant submitted text to Regis AI. Signed-in evidence and monitoring records are associated with the customer account; public guest workflows use limited recovery and save-handoff storage.

Do not submit secrets, identity documents, payment-card information or unnecessary sensitive personal data. Your chosen MCP client or webhook destination can receive data you authorise it to access and has its own security and privacy responsibilities.

Use the Privacy notice for retention criteria and the provider register for supplier roles and transfer questions. Hosting encryption, key management, backup and recovery controls must be reviewed against the applicable infrastructure and customer schedule rather than inferred from an application-level encryption statement.

3. Assurance and procurement evidence

Security certifications apply to a named legal entity, scope, systems and validity period. A parent-company or infrastructure-provider certificate does not automatically certify every CompanyProof workflow. Request the applicable certificate and scope statement before relying on an ISO 27001, SOC 2 or other assurance claim.

For an enterprise review, agree the following evidence and requirements with the service team. This page does not represent that every requested assessment has already been completed.

• Current architecture and supplier schedule, including hosting, backup, support and downstream AI processing locations.
• Applicable assurance reports, penetration-test scope, date and remediation status, shared under suitable confidentiality terms.
• Backup coverage, restoration-test evidence and any agreed recovery-time and recovery-point objectives.
• Operational access reviews, alert ownership, incident escalation and the customer notification process.
• Retention and deletion procedures, evidence of request handling and the treatment of backups and legal holds.
• Availability, support response, maintenance, service-credit and business-continuity commitments expressly included in your order.

4. Report a security concern

Email our support team with CompanyProof security in the subject. Include the affected feature, approximate time, impact and safe reproduction steps. Do not include passwords, API keys, complete payment-card details or copies of other people’s personal information.

If your account credential is exposed, revoke it promptly and contact us. Avoid further access to affected data, destructive testing, persistence, service disruption or public disclosure of live exploit details while a report is being assessed. This page does not authorise testing outside your account or create a paid bug-bounty programme.

Customer personal-data incident notifications and assistance are governed by the DPA and applicable law. The DPA requires notification without undue delay after awareness of a personal-data breach; a specific hourly response or availability SLA exists only if expressly agreed.

5. Shared responsibilities

Protect your sign-in method, use appropriate member roles, rotate exposed keys, verify webhook signatures and control exported evidence. Keep an accurate incident and privacy contact on your account.

CompanyProof provides company-fact evidence. Assess whether your intended regulated or consequential use needs additional controls, checks or contractual commitments. Contact our support team to arrange the relevant security review.