Security
Built like it has to pass its own review
Provebase handles the most sensitive artifacts a company has — its security evidence. These are the principles the product is built on.
Read-only by design
The Drata/Vanta connection uses read-only OAuth scopes. Provebase can see your controls, policies, and evidence — it can never modify your compliance program.
Your credentials stay yours
Portal filling happens through a browser agent working inside your own authenticated session. We never collect, see, or store portal passwords — a security tool that hoards credentials would fail its own review.
Nothing ships without approval
Every answer is reviewed by you before it leaves — whether exported to Excel or filled into a portal. Below the confidence threshold, the agent refuses to answer at all.
Full audit trail
Every generated answer records its source evidence, confidence score, and the human who approved it. When a buyer asks “why did you answer that?”, you have the receipt.
Your data is yours
Evidence and answers are encrypted in transit and at rest, used only to answer your questionnaires, and never used to train models. Delete your account and your evidence base goes with it.
We expect to be reviewed
We sell to security teams — send us your questionnaire. Design partners get our full security documentation and architecture walkthrough. Third-party audit of our own stack is on the pre-launch roadmap.
Responsible disclosure
Found a vulnerability? We want to hear about it. Email security@provebase.ai and we'll respond within two business days.
Send us your security questionnaire
Seriously — we'd love to answer it. It's the fastest way to see how we think about defensibility.
Get early accessor email hello@provebase.ai