ProsentriqSecurity & compliance
What Prosentriq does with your data, what it can prove to an auditor, and how to reach us if something's wrong.
Evidence, generated from what actually happened
Evidence packs are computed from Prosentriq's own records for the period you choose. Each control is marked as evidenced, not yet exercised, or a gap, with the reason (for example, PCI DSS 10.5.1 needs 12 months of retention). Packs are canonical JSON signed with Ed25519, can carry an RFC 3161 timestamp, and embed the head of your tamper-evident audit log.
| Framework | Controls mapped |
|---|---|
| SOC 2 | CC6.1, CC7.1–CC7.4 |
| PCI DSS v4.0 | 8.4.2, 10.2.1, 10.4.1, 10.5.1, 11.5.1 |
| HIPAA Security Rule | 164.312(b), 164.308(a)(1)(ii)(D), 164.308(a)(6)(ii) |
| ISO/IEC 27001:2022 | A.5.25, A.5.26, A.8.5, A.8.15, A.8.16 |
| NIST CSF 2.0 | DE.CM-01, DE.CM-09, DE.AE-02, RS.MI-01, PR.AA-03 |
| NIST SP 800-53 Rev. 5 | SI-4, AU-6, AU-9, IR-4, IA-2(1) |
| CIS Controls v8 | 6.5, 8.2, 8.11, 13.1, 13.3 |
| NIS2 | Art. 21(2)(b), 21(2)(j), 23 |
| DORA | Art. 9, 10, 17 |
Mappings are guidance for your auditor, not a certification. Auditors get a read-only, time-boxed portal link, and anyone can verify a pack offline (prosentriq verify-pack) against our published key. A cyber-insurance pack pre-fills common underwriting questions from the same data.
What we collect, and what we deliberately don't
- Security events and findings from your sensors, retained per your plan (30, 90 or 400 days) and isolated per organization by database row-level security.
- Account email, and only hashes of every credential (API keys, sensor tokens, sessions, links).
- If you opt in to the Immunity Network: attacker IP addresses and a reason category. Never traffic, never which organization reported them.
- No packet payloads, file contents or memory dumps are uploaded.
- The optional AI assistant is off by default; when enabled it receives one incident's reasons with IPs, hosts and users replaced by tokens, can be routed through your own cloud (Bedrock or Vertex), and cannot take actions.
How we protect the thing that protects you
- The host dashboard API requires a per-install token, never reflects CORS, and locks out repeated failures.
- Self-hosted Threat Hub peers talk only over TLS pinned to each other's certificate; an isolated host can still reach only the management plane and its own DNS servers.
- No component shells out: helpers run programs by absolute path with argument vectors.
- Packages come only from apt/dnf repositories whose signing key fingerprint is pinned in the installer; updates refuse any other source.
- Releases carry SBOMs and Sigstore (cosign) signatures; container images are signed with provenance.
- Console accounts use Argon2id passwords, TOTP with recovery codes (never reusable, even mid-outage) or OIDC single sign-on, which never skips a member's own TOTP, and role-based access (owner, admin, analyst, auditor).
- Account recovery always goes through an emailed, single-use confirmation link; nothing rotates on request alone. An account someone registered with your address before you proved it is handed to you clean: their password stops working and you are told about existing keys.
Reporting a vulnerability
Found a security issue in Prosentriq itself? Email security@prosentriq.com (see our security.txt). Please:
- give us a reasonable window to fix it before disclosure;
- avoid accessing or modifying data that isn't yours;
- include reproduction steps, the affected component and version, and impact.
We acknowledge reports within 2 business days and credit researchers who want it.