Security Settings
What ProLens does to protect your data and how to verify it yourself.
ProLens is built around a few hard rules. They are not marketing. Every one is enforced in code. This page covers the user-facing view of those rules; for the architecture see Security.
Read-only
ProLens only reads from your PSA, CRM, and accounting systems. The
adapter interface exposes fetchProjects, fetchInvoices,
fetchTimeEntries, fetchPeople, fetchDeals, fetchBookings.
There is no corresponding create*, update*, or delete* method.
Your data is encrypted at rest
Your financial data, client names, team member information, and cost rates are encrypted at the field level using AES-256-GCM before they reach our database. Each tenant gets its own encryption key. A database backup or unauthorized infrastructure access would expose only encrypted text, not your actual data.
ProLens syncs your data every 15 minutes and refreshes it with the latest from your platform. When you disconnect ProLens, all your data, encryption keys, and cache entries are permanently deleted.
Credentials encrypted
PSA credentials are encrypted with AES-256-GCM envelope encryption. Each row gets its own data encryption key (DEK), the DEK is wrapped with a master key (KEK), and the master key lives in the platform's environment. The raw token is never echoed back through the UI and is decrypted only at the moment ProLens needs to make a request to your PSA. With BYOK enabled, even this credential encryption uses your own key, giving you full control over every encrypted value in ProLens.
You can rotate the token or revoke access entirely from PSA Connections.
Every access is logged
Settings > Security shows your firm's data-access audit trail. Every read of your PSA data, by sync jobs, AI pipelines, cache rebuilds, and individual users, produces a row in the log with a timestamp, the accessor, the action, and the scope of data touched.
Logs are retained for 90 days and filterable by date and accessor type. Export to CSV from the toolbar.
No admin backdoors
ProLens staff cannot access your tenant data without your explicit,
time-limited permission. The codebase contains no impersonate,
view-as-tenant, or switch-tenant code paths. Even users with the
PLATFORM_ADMIN role see only their own tenant's data.
With Bring Your Own Key encryption enabled, even infrastructure access cannot decrypt your data. Your key never touches our systems, so there is no path, technical or human, for a ProLens employee to read your information.
AI never sees your real names
Before any data leaves ProLens for AI analysis, client names, project names, and people names are replaced with opaque tokens. The AI sees structure (counts, dollars, ratios) but never actual names. Responses are deanonymized on the way back.
In transit
Connections to ProLens are HTTPS, and Vercel's edge network terminates TLS. Connections to your PSA from ProLens are HTTPS as well.
For the long-form security overview with architecture diagrams and the subprocessor list, see prolens.io/security.