Security & Trust Architecture
An in-depth, transparent overview of our security measures, encryption protocols, access controls, and data segregation safeguards.
1. Multi-Factor Identity: Password & Proventa Authentication Key
Proventa implements rigorous defense-in-depth protection for both member accounts and Concierge employee workstations:
All account passwords are salted and hashed using bcrypt with an adaptive cost factor of 12 rounds before reaching the database. Plaintext passwords are never logged, stored, or transmitted internally.
"Your private key. Your Proventa identity." Created during onboarding, this private credential is required for every subsequent sign-in. It is stored via dedicated one-way hashing; Proventa personnel cannot view or retrieve it. Attempts are protected by adaptive rate limiting.
2. Role-Based Access Control (RBAC) & Customer Isolation
Database queries enforce strict customer profile isolation. Members can only read and mutate their own tasks, preferences, and payment records.
- Concierge Agents: Can only view task details assigned directly to their active shift queue.
- Concierge Managers: Operational oversight across team tasks without access to unassigned customer payment instruments.
- Founders & Admins: System infrastructure, partner configurations, and immutable audit logs.
3. Encryption in Transit & at Rest
All network communication between member devices and Proventa edge nodes is encrypted using TLS 1.3 with HSTS (HTTP Strict Transport Security) headers.
- Database Storage: Stored on PostgreSQL with transparent disk-level AES-256 encryption.
- Session Cookies: HTTP-Only, Secure, SameSite=Lax/Strict flags preventing script injection and XSS exfiltration.
- Integrations: Partner API keys and webhook secrets encrypted via AES-256-GCM.
4. Microsecond Immutable Audit Logging
Every critical event across Proventa is recorded into an append-only audit log:
| Event Class | Logged Metadata | Security Safeguard |
|---|---|---|
| Authentication | Login successes, failures, password resets, key prompts. | Rate limiting & automated brute-force lockouts. |
| Task Lifecycle | Creation, AI summary generation, concierge assignment, customer approvals. | Traceable chronological custody chain. |
| Data & Privacy | Personal data exports, policy acceptances, erasure requests. | Verifiable compliance records. |
5. Vulnerability Disclosure & Security Inquiries
We welcome responsible security research. If you believe you have discovered a potential security vulnerability or misconfiguration in Proventa, please contact our technical team at privacy@proventa.in.