Security practices at ProvenMap.
We know architecture data can reveal how your systems work. This overview explains how ProvenMap handles that data in the hosted product, what customers control, and where our compliance work stands.
Authentication
Browser sign-in, platform launch, and plugin access use separate credentials with separate scopes.
Your browser
Signs in with AWS Cognito
Portal
Accounts and billing
Agents and plugins
Scoped tokens
Platform
Architecture boards
- You to the portal
AWS Cognito handles sign-in. Passwords do not pass through ProvenMap servers. Google and enterprise SAML or OIDC providers federate into the same user pool.
- The portal to the platform
Opening a workspace creates a signed token for that launch. The token expires in one hour, has no refresh token, and is verified by the platform using public keys. The platform then opens its own session, which lasts at most eight hours.
- Agents and plugins to the platform
Plugins and agents use scoped access tokens. Repository credentials are tied to one board and branch. Personal agent tokens can be read-only or read-and-write.
AWS Cognito
Short-lived RS256 token
Scoped access tokens
Account protection
- Multi-factor authentication (MFA)
- Users can turn on TOTP MFA in their profile — a time-based one-time password from an authenticator app. SMS is not offered as a second factor. It is available per user rather than mandated across an organisation.
- No account enumeration
- Sign-in, sign-up and password reset answer the same way whether or not an address is registered, so the forms cannot be used to find out who has an account.
- Email-only recovery
- Account recovery runs through the registered email address. SMS is not a recovery channel, so there is no phone-number route into an account.
Repository data
ProvenMap plugins read repositories in your coding session and send architecture metadata when a command runs, whether you run it or a schedule you set does. The repository itself is not uploaded.
Stays in your session
- The repository itself
- Source code, apart from the authorization policy files /aspects reads
- Plugin credentials, beyond the request headers that authenticate a call
Crosses the wire, when a command runs
- Component and connection names, short descriptions capped at about 500 characters, and the longer explanations your agent writes for them
- File paths and line ranges
- The module paths your import statements name, and the symbols imported between files
- Passages /ground quotes from your repository's documents as evidence, each capped at about 500 characters
- What /aspects reads: your API routes, table and column definitions, message channels, page routes, and the full text of authorization policy files
- Screenshots of your running app that /inspect captures, with the page address and on-screen element labels
- Insights, context boards and work-item notes your agent writes about your code
- Findings /monitor draws from your production signals, pushed as insights
- What your agent writes to a workspace through pmap-workspace, including, at /setup, the manifest and dependency names it scanned
- Your repository's git remote URL, branch, current commit and first commit
- The project name, and the repository folder name at sign-in
- A one-sentence summary of a sync, when your agent writes one
- Which agent pushed (Claude Code, Codex or Cursor), the plugin version, the operating system type and a one-way hash of the machine
- Who committed in each period /changes reads, by name only and never by email address, each paired with the coding agent, model and editor their commits name; a short summary of each piece of work; and up to five changed file paths per change rule
- Each scheduled run's outcome, branch and commits, up to five file paths with uncommitted changes, and, when it stops, the error line, capped at 1,000 characters
The file and import paths on components and connections can be turned off with includeSourceReferences: false. Connection descriptions still name the files and imported symbols behind each connection, and /ground, /changes, /aspects and /inspect send what they list regardless; skip a command to keep its data in your session. Read the policy.
Language model access
- Your own model account
- The organisation connects its own model provider (OpenRouter) over OAuth, and inference then runs under that account’s agreement and billing. Until it does, a limited trial allowance runs on ProvenMap’s own OpenRouter account.
- Organisation-scoped
- A provider connection belongs to the organisation that linked it. Cached model lists use a token hash, not the token.
- No background crawler
- ProvenMap has no access to your repository and does not scan it. Analysis happens only while a plugin command runs: one you type, or one on a schedule you create yourself, such as a Claude Code scheduled task.
Connected tools
- Sentry, read hourly
- When an owner or admin adds a Sentry API key and binds a project to an app, ProvenMap reads that project's unresolved issues every hour and files the new or returning ones as draft insights. The key needs read access only.
- Slack, only what you set up
- ProvenMap posts to Slack only for an automation an owner or admin creates, or a share someone sends. Each post names a board, work item or insight and links back to it. ProvenMap reads the channel list and the user profiles it needs to address a post, never messages.
- Connector keys encrypted
- Sentry keys and Slack tokens belong to the organisation and are encrypted at rest with AES-256-GCM. Unlike the credentials below they are not hashed, because ProvenMap has to use them.
Credential management
Plugin credentials and agent tokens use the same token system.
- 01
Shown once
At creation, never again
- 02
Stored hashed
SHA-256, not the secret
- 03
Used and recorded
Last use, machine print
- 04
Expired or revoked
Effective next request
- Stored as hashes
- Tokens are shown once, then stored and looked up by hash. The raw secret is not retained.
- Separate token types
- Repository credentials and personal agent tokens are not interchangeable. Each type has its own scope.
- Agent tokens expire
- Personal agent tokens carry an expiry between one and 365 days, pre-filled at 90.
- Per-machine plugin credentials
- Each plugin sign-in receives its own credential, which lasts until it is revoked. Revoking one machine does not revoke other installs. A cloud schedule runs on a credential you copy into its settings, so it shares that credential with the machine it came from.
- Scoped before use
- Agent tokens can be read-only or read-and-write, and can be restricted to one board and the boards beneath it.
Tenant isolation
Customer data is separated by organisation, workspace, repository binding, and board access.
The tenant boundary
A body of architecture work
One repo, one board, one branch
The credential
Every level above must be named
A credential naming its binding, workspace and organisation is storable.
One with a gap in that chain is rejected by the database itself.
- No unfenced credential list
- The repository layer does not expose a method that lists credentials without a tenancy filter.
- Cross-organisation access fails closed
- A request using credentials for one organisation to reach another is rejected.
- Portal and platform are separate databases
- Account and billing data live apart from architecture content, with separate database instances and credentials.
Enterprise SSO
Single sign-on is available on the Team plan and above for organisations that want identity-provider enforcement.
- SAML or OIDC
- Okta, Entra ID, and other SAML or OIDC providers register through AWS Cognito. Cognito validates assertions and certificates.
- Verified domains and required SSO
- A domain is trusted after DNS verification. When SSO is required for that domain, password and Google sign-up are refused at the identity layer.
- Seats are enforced
- Users are created on first sign-in within the organisation seat limit.
- Board access remains separate
- Organisation roles, board access and published links are controlled independently.
Infrastructure security
The hosted product runs on AWS. Production infrastructure is defined in version-controlled infrastructure-as-code.
Network and encryption
- Database access is limited to the services that need it, inside a private network
- Administrative database sessions require an authenticated AWS session, and each session start is logged in CloudTrail
- Databases are encrypted at rest
- Connections to the database use TLS in production
- Web and API traffic is served over HTTPS
- Secrets are held in AWS Secrets Manager and SSM Parameter Store
Durability and recovery
- Production databases run Multi-AZ
- Automated backups keep 14 days of point-in-time recovery
- Deletion protection on production databases
- Database logs, performance metrics and alarms are in CloudWatch
Abuse prevention
- AWS WAF protects the identity pool with rate limiting and Bot Control
- APIs enforce per-IP rate limits
- Sign-up is screened before an account is created
- Programmatic AWS access uses a dedicated least-privilege identity
Audit and data deletion
You can reconstruct important actions and request deletion through a defined process.
Deleting your data
Request
You ask for deletion
30-day grace
Cancellable until it ends
Purge issued
Instruction sent to the platform
Confirmed
The platform reports completion
If confirmation does not arrive within seven days, the request is flagged for an administrator rather than assumed complete.
- Audit trail
- Important actions, including plugin pushes, record the actor, organisation, workspace and repository binding. Plugin and agent sign-in approvals also record the source address.
- No secrets in logs
- Audit events do not include credential material, and token-bearing URLs are redacted before logging.
- Self-hosting
- ProvenMap is available as a self-hosted deployment for organisations that cannot send architecture data to a hosted vendor.
Subprocessors
The hosted product uses the subprocessors below. This list can be confirmed in a data processing agreement.
| Provider | Purpose | What it processes |
|---|---|---|
| Amazon Web Services | Hosting, databases, identity, storage | All hosted application and account data |
| Stripe | Payments and subscription billing | Billing contact and address, company name, tax ID and payment details |
| Resend | Transactional email delivery | Recipient address and message content |
| Sentry | Error and performance monitoring | Diagnostic and error context, including a replay of the app session leading up to an error, with on-screen text |
| Sanity | Marketing and documentation content | No customer data — published content only |
| OpenRouter | Language-model access: your organisation’s connected account, or ProvenMap’s account during a trial (Anthropic models, served through AWS Bedrock) | The conversation content you send to a model |
| Kickbox | Email address verification at sign-up and on public forms | The email address being verified |
| Chatwoot | Support chat: on the website only with analytics consent, and in the app for signed-in users | Chat messages, the details a visitor chooses to share, and a signed-in user’s name, email and workspace |
| Cloudflare | Bot checks on public forms (Turnstile) | IP address and browser signals from the visitor’s browser |
| Google Analytics | Usage analytics on the website and published boards, only with analytics consent | Pages visited, device and browser data, IP address |
| YouTube (Google) | Product videos on the website | IP address and browser data when a video poster or player loads |
Hosted infrastructure runs in AWS US East (N. Virginia). The subprocessors above process data in their own regions, and trial model requests may be served from other US regions. Regional residency is not available for hosted deployments. Self-hosting is available for strict residency requirements.
Compliance status
The items below reflect the current hosted product. Controls are stated as they exist today; certifications and external assessments are listed only after they are complete.
In place today
- Encryption at rest and in transit across databases, storage and traffic
- Enterprise SSO with SAML and OIDC, and enforced-SSO domains
- Hashed, individually revocable credentials with usage recorded; agent tokens expire
- Per-user TOTP MFA
- Credential tenancy enforced by database constraint
- Audit trail and defined data-erasure process
- Self-hosted deployment for organisations that need it
Not in place today
- SOC 2 and ISO 27001
- Not certified. ProvenMap has not completed a formal audit. Security questionnaires are answered on request.
- Organisation-wide MFA enforcement
- Not available from the portal. Users can enable TOTP MFA today; for a hard requirement, enforce MFA in your identity provider and require SSO for your domain.
Vulnerability disclosure
Reporting a vulnerability
Report security issues by email rather than in a public issue. We will acknowledge the report and provide updates during investigation.
security@provenmap.comFor a questionnaire, DPA, or engineer-led walkthrough, contact us.
Talk to us