Home/Security & Your Data
Security & Your Data
Isolated by Design, Yours to Export
ProVo PM is a cloud product: your workspace's plans, budgets, risk registers and defect lists are held on Google Cloud in a US region so your team can work them together, with every person signing in through your own identity provider. The commitment that has to earn is that your data is never mixed with another firm's, and never held hostage by us.
Where Data Lives Today
One Workspace, Isolated by Design
Schema Isolation
Each backend service runs its own Postgres schema behind its own database role. The service that owns project trackers has no grant on billing or identity data; a query that tried to join across that boundary would fail at the database, not just in application code.
Row-Level Security, per Workspace
Inside a shared schema, every query is scoped by your workspace id at the database layer, not just by application logic. Your firm's rows are invisible to a query running for another workspace by construction, not by a check someone could forget to write.
What Leaves
What Crosses the Network, and When
| Data | Where It Goes |
|---|---|
| Project Content Tasks, hours, rates, budgets, risks, defects, migration counts, notes, client names | Held in Google Cloud SQL in a US region (us-central1), isolated to your workspace by row-level security, encrypted with TLS in transit and AES-256 at rest, and backed up daily. This is what makes several people editing one plan at once possible. |
| Exports | Go wherever you send them. A CSV, Excel or PDF export is an ordinary file on your disk from the moment it is created, and it contains only what your role is allowed to see. |
| Estimator Worksheet | Saved in your browser on the device you used, not on our servers, until you choose Update Plan & Budget, which writes the hours, bill rate and contingency into the shared project. |
| Subscription and Billing | Handled by our payment processor. It receives your plan and payment details, never project content. |
| Fonts and Page Assets | The application requests web fonts from a public font CDN when it opens. No project data is attached to that request. If your client's policy forbids outbound CDN calls, tell us before you start and we will work through it with you. This website serves its own fonts and makes no third-party requests at all. |
If your client's security review needs this in writing against their specific questions, ask us and we will answer them directly rather than pointing at a trust page.
The Commitment
You Can Always Get Your Data Out
Every tracker exports as CSV that opens in any spreadsheet, and the same file imports back in with a preview before anything is saved. Queries, timesheets and the timeline also export to Excel, and reports to PDF.
That export is deliberately not a locked format. The CSV columns are the same ones the import reads, so your data always leaves in a shape you can use without us.
Make Export Part of the Rhythm
We back the database up daily. Your own copies are still worth keeping, the way you would for any system of record.
- Export the trackers to CSV at each gate as your own snapshot
- Keep it somewhere your firm already backs up
- Export the Status Report to PDF at each gate for a record of what was reported
How Access Is Controlled
Security Controls in the Product Today
Single Sign-On Through Your Identity Provider
People sign in with your firm's own identity provider through Cloudflare Access (Okta today). Each firm has its own address that accepts only that provider, and there are no separate ProVo PM passwords to manage or leak.
MFA Enforced by Your Identity Provider
Multi-factor rules are the ones your identity provider already applies, so your existing policy covers ProVo PM from the first sign-in.
Encrypted in Transit and at Rest
TLS on every connection. Data at rest is encrypted with AES-256 on Google Cloud.
Roles Checked on the Server
Four built-in roles plus up to 50 of your own, each page set to Hidden, View or Edit, with a separate Financials switch for rates and costs. The server checks the role on every read and write, so data from a hidden page never reaches that person's browser.
Every Change Recorded With Its Author
Each edit is stored on the server with the signed-in person who made it. When two people change the same field, the later edit wins and the person whose edit lost is told.
Daily Backups in a US Region
The database runs on Google Cloud in us-central1 and is backed up daily.
Running a security review for a client? We will answer the questionnaire directly.
Questions from a Client Security Review?
Send them over. We will answer the actual questions rather than send a certificate.