Security

How ProoV UG (haftungsbeschränkt) protects the data on its platform, where the platform runs, and how to report a vulnerability. Security and procurement teams can ask us for the documents listed under Documents for your review.

Certification status

• ISO 27001 certification in progress. We are setting up an information security management system to ISO/IEC 27001:2022, to be certified by an accredited certification body.
• SOC 2 audit in progress. A SOC 2 Type II report on the same controls follows the ISO 27001 work.

We will publish each certificate and report here once it is issued. Microsoft Azure, where ProoV runs, holds its own ISO 27001 certificate and SOC 2 reports for its data centres and services.

Where ProoV runs

The platform runs on Microsoft Azure in Europe. The API, the database and the cache run in North Europe (Ireland); files and the websites in West Europe (Netherlands), with a geo-redundant copy of the files in Ireland. Cloudflare sits in front of our websites and API and blocks attacks.

AI features use Microsoft’s Azure OpenAI service. Most of its models run as Global deployments, which may process a request in any Azure region, and the move to EU Data Zone deployments is under way. Every provider, with what it receives and where, is on our sub-processors page.

How we protect data

• Encryption. Every page and API call is served over HTTPS. The database, the file store and the cache accept only TLS 1.2 or newer, and Azure encrypts the database, files and backups at rest with AES-256.
• Access. Each role sees only what it needs: every API route stays closed unless it names the roles that may use it or is public, such as sign-in. Passwords are stored as bcrypt hashes. Every account can turn on two-factor sign-in, and accounts with admin rights must use it from 18 November 2026. When staff open a learner’s or a company’s records, the read is logged.
• Changes to the code. Code reaches production through pull requests, each checked by automated tests, type checks and a dependency audit. Dependabot checks the dependencies every week, and the API’s deployments sign in to Azure with short-lived credentials.
• Monitoring. Microsoft Defender for Cloud watches the servers, storage, containers, database and key vault. The websites and the API are checked every five minutes from three regions, and alerts go straight to the founders.
• Backups. The database can be restored to any point in the last 14 days. A nightly copy goes to a separate, geo-redundant store, and every backup is kept for at most 90 days. Deleted backups stay in a recovery bin for up to 15 more days, then they are removed for good. A restore drill on 11 November 2026 brought a full copy of the database back in under 8 minutes.

How grading works

One AI evaluator on Azure OpenAI scores each submission against the project’s published rubric. An individual submission reaches it without the learner’s name or email address. A person reviews a result whenever the model is unsure or an integrity check raises a flag, and every learner can ask a person to review any result. Under Microsoft’s terms, Azure OpenAI does not use these requests to train models, and ProoV trains no model on submissions. The legal detail is in section 3 of our privacy policy.

Security incidents

If an incident affects personal data, we tell the affected customers without undue delay, and report it to the data protection authority of Baden-Württemberg within 72 hours where the GDPR requires it. To report a suspected incident, email [email protected].

Documents for your review

Security and procurement teams can ask for:

• our security overview, which covers hosting, data flows, encryption, access control, grading and incident handling;
• a completed SIG Lite or CSA CAIQ questionnaire, or your own;
• the platform’s availability history, month by month.

Email [email protected]. Some documents are shared under a non-disclosure agreement.

Report a vulnerability

If you find a security weakness in ProoV, email [email protected], in English or German. Tell us what you found and where, the steps to reproduce it, and what an attacker could do with it. A founder reads every report.

Scope

Our websites and API at goproov.com, api.goproov.com and experience.goproov.com, and the earlier addresses that still lead to them (projectstudy.in, www.projectstudy.in, www.goproov.com, proov.projectstudy.in). Report a weakness in a provider’s own service, such as Microsoft or Cloudflare, to that provider.

While you test

• Use only your own accounts.
• Stop as soon as you reach someone else’s data. View only what you need to show the problem, keep none of it, and tell us what you saw.
• Leave out denial-of-service tests, automated scans that slow the service, social engineering, spam and physical attacks.
• Keep the details to yourself until the problem is fixed. We agree a date for publication with you.

What we do

We confirm that we have your report, keep you informed while we fix the problem, and tell you when it is fixed. With your permission, we thank you by name on this page. We run no paid bug bounty at present.

Safe harbour

If you act in good faith and follow these rules, we treat your research as authorised, and we will not take legal action or file a criminal complaint against you for it.

The same details, in machine-readable form, are in our security.txt.