ProgullProgull
Request a demo
Trust Center

Security and trust, in one place.

A consolidated view of how Progull handles customer environments, data and incidents. Maintained by the Progull security team. Anything not stated here is available on request.

Progull is a pre-seed company. This page describes the trust posture the platform is being built to — not an existing attested audit. There is currently no completed SOC 2 report, ISO certificate or independent pen-test summary. Where a certification is listed as "In preparation" or "Roadmap", that is what it means. Updates will publish as they land. For architecture questions in the meantime, write to zeeshan.afzal@progull.com.
Certifications & frameworks

What we attest, what we align to.

SOC 2 Type II

In preparation

Architecture and controls being built to SOC 2 Type II. Audit will follow first design-partner deployments — no attestation exists yet.

ISO/IEC 27001

In preparation

ISMS being scoped alongside the platform build. Certification is on the post-pilot roadmap.

GDPR

Design intent

Platform is being designed to support GDPR-compliant data handling, DPAs and SCCs. Formal DPA templates will publish before the first paying customer.

HIPAA

Roadmap

BAA-readiness is on the post-pilot roadmap; not offered today.

PCI-DSS

Out of scope

Progull is architected to never store cardholder data. A documented descoping approach ships with v1.

Data handling

What we collect, where it lives, how long it stays.

Data collected
Telemetry, abend metadata, log excerpts, ticket fields, reasoning traces.
Data not collected
Cardholder PAN, member PHI payloads, end-customer PII fields. Redaction enforced at ingest.
Customer-content residency
Pinned per tenant: US, EU, UK, IN, SG, JP. No cross-region replication without written approval.
Retention (operational)
90 days hot, 365 days warm, configurable archive up to 7 years.
Retention (audit)
7 years immutable (WORM-equivalent storage).
Deletion
Verified within 30 days of written request. Audit trail of deletion retained.
Encryption & key management

At rest, in transit, end-to-end signed.

In transit
TLS 1.3 only. mTLS for all mainframe-side connectors.
At rest
AES-256-GCM. BYOK supported via AWS KMS, Azure Key Vault, HashiCorp Vault.
Reasoning traces
Signed (Ed25519) and encrypted per tenant. Tamper-evident chain.
Secrets
Brokered through Vault / CyberArk. No long-lived credentials at rest in Progull.
Resilience

Recovery objectives are stated, measured and tested.

RPO
≤ 5 minutes
RTO
≤ 30 minutes
Uptime SLO
99.95% control plane
DR posture
Active / active across two regions per tenant
Backup frequency
Continuous WAL + 15-min full snapshots
Last DR exercise
Q2 2026 (passed; report available)
Sub-processors

The third parties Progull uses.

Vendor
Purpose
Region
AWS
Primary hosting (control plane + tenant data plane)
Per tenant
Microsoft Azure
Hosting (Azure-pinned tenants)
Per tenant
Cloudflare
Edge, WAF, DDoS mitigation
Global anycast
Datadog
Progull-internal observability
US / EU
PagerDuty
Progull-internal on-call
US
Snowflake
Internal analytics warehouse
US (no customer-content)

Customers on Enterprise plans receive 30-day written notice of any sub-processor addition with a right to object.

Security program

Operating practices behind the platform.

Penetration testing
Annual third-party + continuous internal red-team exercises.
Vulnerability management
Critical patched ≤ 7d, High ≤ 30d. Tracked in SLO.
Secure SDLC
Threat modeling per epic. SAST + DAST + SCA on every PR. Two-eyes review enforced.
Personnel
Background checks at hire. Security training on hire + annually.
Endpoint
MDM-managed, FDE-enforced, EDR everywhere. No BYOD against production.
Vendor program
Risk-assessed onboarding. Annual re-review. DPA on file for every sub-processor.
Incident response

What happens when something goes wrong.

Severity model
Sev-1 (customer-impacting) → page < 5 min. Sev-2 → < 15 min. Sev-3 → next business hour.
Customer notification
Sev-1 affecting your tenant: notified within 1 hour. Written RCA within 5 business days.
Regulatory notification
Personal-data breach: regulators notified within 72 hours per GDPR.
Disclosure
Coordinated disclosure for vendor / library findings. Public CVE within 90 days where applicable.

Vulnerability disclosure

zeeshan.afzal@progull.com

PGP key available on request. Safe-harbour for good-faith research.

DPA & contract

zeeshan.afzal@progull.com

Standard DPA, SCCs and UK addendum available. Custom terms reviewable.

Data-subject requests

zeeshan.afzal@progull.com

GDPR / CCPA access, rectification and deletion requests routed to the DPO.

Read the full security FAQ Talk to a Progull engineer