Security and trust.

How Probara handles your data, protects API traffic, and accepts vulnerability reports.

Encryption in transit

All API traffic is TLS 1.3. HTTPS is enforced at the edge. No plaintext connections are accepted. Certificate management is handled by the infrastructure provider.

TLS 1.3 · HTTPS enforced · HSTS

Encryption at rest

Evidence corpus data, attestation records, and API keys are stored with AES-256 encryption at rest via the underlying infrastructure volume. API keys are stored as bcrypt hashes, never in plaintext.

AES-256 at rest · Keys hashed (bcrypt)

HMAC attestation

Every evidence card is HMAC-SHA256 signed at the moment of the call. Recompute the digest with your shared API key: a match confirms the card is byte-for-byte identical to what the server issued.

HMAC-SHA256 · Shared-key tamper-evident

What we log and retain

Request logs Retained 90 days. Includes: API key ID (not plaintext), endpoint, timestamp, HTTP status, request ID. Does not include: ingredient query payload after processing completes.
Attestation records Retained indefinitely. These are the receipts that make evidence verifiable. Deletion on request will invalidate any attestation IDs derived from your account.
Billing data Handled by Stripe. Probara does not store card numbers. See subprocessors page for the full list.
Analytics Plausible Analytics (cookieless, GDPR-compliant, no personal data). PostHog in memory-only mode (no persistent cookies).

Compliance roadmap

SOC 2 Type II In progress. Targeting audit in Q4 2026. We will publish the report when certified. We do not claim certification we do not hold.
GDPR Data Processing Agreement (DPA) available on request. EU data is processed on US infrastructure. See subprocessors page.
Penetration testing Scheduled annually. Results available to Enterprise customers under NDA.

Responsible disclosure

If you discover a security vulnerability in Probara, please report it before public disclosure. We commit to acknowledging your report within 48 hours and keeping you updated as we investigate.

Contact security@probara.dev
Response SLA 48 hours acknowledgment · 7 days for initial assessment
Scope probara.dev and any Probara-controlled infrastructure
Out of scope Third-party services (Stripe, Cloudflare, Railway), social engineering, physical access
Preferred format Description of the issue, steps to reproduce, and potential impact. PGP encryption available on request.

We do not currently offer a bug bounty program. We do credit researchers in our security acknowledgments with their permission. We will not pursue legal action against good-faith researchers who follow this policy.

Machine-readable /.well-known/security.txt