Security

ProLens is built around a few hard rules. They are not policy. Every one is enforced in code.

Read-only by design

ProLens only reads from your PSA, CRM, and accounting systems. The adapter interface exposes fetchProjects, fetchInvoices, fetchTimeEntries, fetchPeople, fetchDeals, and fetchBookings. There are no corresponding create*, update*, or delete* methods anywhere in the codebase.

Your data is encrypted at rest

Your financial data, client names, team member information, and cost rates are encrypted at the field level using AES-256-GCM before they reach our database. Each tenant gets its own encryption key, generated the moment you connect your platform. A database backup or unauthorized access to our infrastructure would expose only encrypted text, not your actual data.

With Bring Your Own Key (BYOK) encryption, you can connect your own key from AWS KMS, Google Cloud KMS, or Azure Key Vault. When BYOK is enabled, ProLens never possesses your key. Revoke it, and your data becomes permanently unreadable.

ProLens syncs your data every 15 minutes and refreshes it with the latest from your platform. When you disconnect ProLens, all your data, encryption keys, and cache entries are permanently deleted.

Credentials encrypted

PSA credentials use AES-256-GCM envelope encryption: each row gets its own data encryption key (DEK), the DEK is wrapped with a master key (KEK), and the master key lives in the platform environment. The raw token is never echoed back through the UI and is decrypted only at the moment ProLens needs to make a request to your PSA. With BYOK enabled, even this credential encryption uses your own key, giving you full control over every encrypted value in ProLens.

Every access is logged

The Security audit log shows every read of your PSA data, by sync jobs, AI pipelines, cache rebuilds, and individual users, with a timestamp, the accessor (system / user / AI), the action, and the scope of data touched. Logs are retained for 90 days.

No admin backdoors

ProLens staff cannot access your tenant data without explicit, time-limited permission. The codebase has no "impersonate", "view as tenant", or "switch tenant" code paths. Even users with the PLATFORM_ADMIN role see only their own tenant's data, because tenant scope is resolved from the signed-in user's JWT at every database query. This is enforced architecturally, not by policy.

With Bring Your Own Key encryption enabled, even infrastructure access cannot decrypt your data. Your key never touches our systems, so there is no path, technical or human, for a ProLens employee to read your information.

AI never sees real names

Before any data leaves ProLens for AI analysis, client names, project names, and people names are replaced with opaque tokens. The AI sees structure (counts, dollars, ratios) but never actual names. Responses are deanonymized on the way back.

In transit

All connections to and from ProLens use HTTPS. TLS is terminated by Vercel at the edge. Connections from ProLens to your PSA are HTTPS as well.

SOC 2

SOC 2 Type I is in progress. The subprocessor list and architecture diagrams are at prolens.io/security.

Configuring access yourself

Signed-in administrators can review the audit log and adjust data visibility in Settings > Security Settings and Settings > Data Visibility.