Trust centre
Documents, controls and current status.
Most of this is published outright. Two documents are restricted-use and need a signed NDA first.
Operational
All systems normal
SOC 2
Type 1 complete · Type 2 underway
Penetration testing
External firm · annual
Proga Digital has completed its SOC 2® Type 1 examination for the Security, Confidentiality and Availability Trust Services Criteria, performed by Prescient Assurance.
Type 2 observation period underway · report expected Q1 2027
Available now
Sub-processor list
Every vendor that touches customer data, with region and purpose. Published in full below.
Read it hereSecurity questionnaire
CAIQ-Lite, pre-filled. Answers most of what a standard review asks before you send us your own.
Request a copyArchitecture overview
Data flows, trust boundaries, what is stored and where.
Read the security pageIncident response summary
Severity definitions, notification commitments, escalation path.
Read the summaryUnder NDA
SOC 2 Type 1 report
The full examination report from Prescient Assurance. Restricted-use — the AICPA requires it be shared only with those who have signed for it.
Request accessPenetration test report
Full findings and remediation status. The summary above is public; the detail is not.
Request accessSub-processors
| Vendor | Purpose | Region | Customer data |
|---|---|---|---|
| Google Cloud | Hosting, database, object storage | us-central1 | All customer data at rest |
| Anthropic | Model inference | US | Prompt content · zero-retention agreement |
| OpenAI | Embeddings and optional completions | US | Indexed chunk text, unless BYO embedder is configured |
| Postmark | Transactional and broadcast email | US | Recipient addresses, message content |
| Stripe | Payments | US | Billing contact and payment method |
| Slack | Notifications, where enabled by the customer | US | Message content the customer sends |
30 days’ notice before any addition. Subscribe to changes
Something not here?
Email security@releap.app. If a reviewer needs a document that does not exist yet, we would rather write it than have you guess.