SecurityRev 2026-09-14

Security practices at ProvenMap.

We know architecture data can reveal how your systems work. This overview explains how ProvenMap handles that data in the hosted product, what customers control, and where our compliance work stands.

Shared responsibility

ProvenMap secures the hosted application, platform, and cloud infrastructure we operate. Customers control how they connect repositories, manage identity, choose model providers, and decide what architecture data to send.

ProvenMap-managed controls: Authentication, token handling, tenant isolation, hosted infrastructure, audit logging, subprocessors, and deletion workflows are managed by ProvenMap for the hosted product.
Customer-managed controls: Customers manage workspace membership, board access, SSO configuration, repository access, plugin use, and any connected language-model provider account.
Self-hosted deployments: For self-hosted deployments, customers operate the infrastructure and are responsible for their own network, identity, backup, monitoring, and residency controls.

Authentication

Browser sign-in, platform launch, and plugin access use separate credentials with separate scopes.

Your browser

Signs in with AWS Cognito

No password sent

Portal

Accounts and billing

RS256 · 1 hour

Agents and plugins

Scoped tokens

Scoped · expiring · revocable

Platform

Architecture boards

You to the portal: AWS Cognito handles sign-in. Passwords do not pass through ProvenMap servers. Google and enterprise identity providers federate into the same user pool.
The portal to the platform: Opening a workspace creates a signed token for that launch. The token expires in one hour, has no refresh token, and is verified by the platform using public keys.
Agents and plugins to the platform: Plugins and agents use scoped access tokens. Repository credentials are tied to one board and branch. Personal agent tokens can be read-only or read-and-write.

Account protection

Multi-factor authentication (MFA): Users can turn on TOTP MFA in their profile — a time-based one-time password from an authenticator app. SMS is not offered as a second factor. It is available per user rather than mandated across an organisation.
No account enumeration: Sign-in, sign-up and password reset answer the same way whether or not an address is registered, so the forms cannot be used to find out who has an account.
Email-only recovery: Account recovery runs through the registered email address. SMS is not a recovery channel, so there is no phone-number route into an account.

Repository data

ProvenMap plugins read repositories locally and send architecture metadata when a command is run. The repository itself is not uploaded.

Stays on your machine

The repository itself
File contents beyond the listed excerpts
Project-local credentials

Crosses the wire, when you run a command

Component names and descriptions, each capped at about 500 characters
File paths and line ranges
Short source-code excerpts, each capped at about 500 characters
Your repository's git remote URL, branch, and current commit
The project name

Source excerpts are capped at about 500 characters and can be disabled with includeSourceReferences: false. Read the policy.

Language model access

Customer-owned model account: The organisation connects its own model provider over OAuth. Inference runs under the customer provider agreement and billing account, not a shared ProvenMap model pool.
Organisation-scoped: A provider connection belongs to the organisation that linked it. Cached model lists use a token hash, not the token.
No background crawler: ProvenMap does not scan your repository on a schedule. Analysis starts when someone runs a command.

Credential management

Plugin credentials, agent tokens, and integrations use the same token system.

01
Shown once
At creation, never again
02
Stored hashed
SHA-256, not the secret
03
Used and recorded
Last use, machine print
04
Expired or revoked
Effective next request

Stored as hashes: Tokens are shown once, then stored and looked up by hash. The raw secret is not retained.
Separate token types: Repository credentials and personal agent tokens are not interchangeable. Each type has its own scope.
Agent tokens expire: Personal agent tokens carry an expiry between one and 365 days, pre-filled at 90.
Per-machine plugin credentials: Each plugin sign-in receives its own credential. Revoking one machine does not revoke other installs.
Scoped before use: Agent tokens can be read-only or read-and-write, and can be restricted to one board.

Tenant isolation

Customer data is separated by organisation, workspace, repository binding, and board access.

Organisation

The tenant boundary

Workspace

A body of architecture work

Repository binding

One repo, one board, one branch

The credential

Every level above must be named

A credential naming its binding, workspace and organisation is storable.

One with a gap in that chain is rejected by the database itself, not by a code review.

No unfenced credential list: The repository layer does not expose a method that lists credentials without a tenancy filter.
Cross-organisation access fails closed: A request using credentials for one organisation to reach another is rejected and logged.
Portal and platform are separate databases: Account and billing data live apart from architecture content, with separate database instances and credentials.

Enterprise SSO

Single sign-on is available on the Team plan and above for organisations that want identity-provider enforcement.

SAML or OIDC: Okta, Entra ID, and other SAML or OIDC providers register through AWS Cognito. Cognito validates assertions and certificates.
Verified domains and required SSO: A domain is trusted after DNS verification. When SSO is required for that domain, password and Google sign-up are refused at the identity layer.
Seats are enforced: Users are created on first sign-in within the organisation seat limit.
Board access remains separate: Organisation roles, board access and published links are controlled independently.

Infrastructure security

The hosted product runs on AWS. Production infrastructure is defined in version-controlled infrastructure-as-code.

Network and encryption

Database access is limited to the services that need it, inside a private network
Administrative database sessions require an authenticated AWS session and are recorded
Databases are encrypted at rest
Connections to the database use TLS in production
Web and API traffic is served over HTTPS
Secrets are held in AWS Secrets Manager and SSM Parameter Store

Durability and recovery

Production databases run Multi-AZ
Automated backups keep 14 days of point-in-time recovery
Deletion protection on production databases
Database logs, performance metrics and alarms are in CloudWatch

Abuse prevention

AWS WAF protects the identity pool with rate limiting and Bot Control
APIs enforce per-IP rate limits
Sign-up is screened before an account is created
Programmatic AWS access uses a dedicated least-privilege identity

Audit and data deletion

You can reconstruct important actions and request deletion through a defined process.

Deleting your data

Request
You ask for deletion
30-day grace
Cancellable for the whole window
Purge issued
Instruction sent to the platform
Confirmed
The platform reports completion

If confirmation does not arrive within seven days, the request is flagged for an administrator rather than assumed complete.

Audit trail: Important actions, including plugin pushes, record the actor, organisation, workspace, board and source address.
No secrets in logs: Audit events do not include credential material, and token-bearing URLs are redacted before logging.
Self-hosting: ProvenMap is available as a self-hosted deployment for organisations that cannot send architecture data to a hosted vendor.

Subprocessors

The hosted product uses the subprocessors below. This list can be confirmed in a data processing agreement.

Provider	Purpose	What it processes
Amazon Web Services	Hosting, databases, identity, storage	All hosted application and account data
Stripe	Payments and subscription billing	Billing contact and payment details
Resend	Transactional email delivery	Recipient address and message content
Sentry	Error and performance monitoring	Diagnostic and error context
Sanity	Marketing and documentation content	No customer data — published content only
OpenRouter	Language-model access, connected with your own account	Only what you send for analysis, under your own provider agreement
Kickbox	Email address verification at sign-up and on public forms	The email address being verified
Chatwoot	Website chat, loaded only with analytics consent	Chat messages and the details a visitor chooses to share
Cloudflare	Bot checks on public forms (Turnstile)	IP address and browser signals from the visitor’s browser

Hosted infrastructure runs in AWS US East (N. Virginia). Regional residency is not available for hosted deployments. Self-hosting is available for strict residency requirements.

Compliance status

The items below reflect the current hosted product. Controls are stated as they exist today; certifications and external assessments are listed only after they are complete.

In place today

Encryption at rest and in transit across databases, storage and traffic
Enterprise SSO with SAML and OIDC, and enforced-SSO domains
Hashed, expiring, individually revocable credentials with usage recorded
Per-user TOTP MFA
Tenant isolation enforced by database constraint
Audit trail and defined data-erasure process
Self-hosted deployment for organisations that need it

Not in place today

SOC 2 and ISO 27001: Not certified. ProvenMap has not completed a formal audit. Security questionnaires are answered on request.
Organisation-wide MFA enforcement: Not available from the portal. Users can enable TOTP MFA today; for a hard requirement, enforce MFA in your identity provider and require SSO for your domain.

Vulnerability disclosure

Reporting a vulnerability

Report security issues by email rather than in a public issue. We will acknowledge the report and provide updates during investigation.

security@provenmap.com

For a questionnaire, DPA, or engineer-led walkthrough, contact us.

ProvenMap

Product

Company

Legal

Syntaxia App Platform Ltd. Registered in England and Wales, company no. 15272701 Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, United Kingdom contact@provenmap.com