Security

The security controls that are in place in ProvenBatch today, and how to tell us if you find a problem.

Published 10 September 2026

1. What this page is

1.1 This page lists security controls that are in place in the ProvenBatch service today. It is a plain description of how the service is built, not an audit result. We would rather name what is actually running than imply anything we have not done.

1.2 Stella Apps, trading as ProvenBatch, is the operator. Questions about this page go to support@provenbatch.co.uk.

2. How to report a security issue

2.1 Email support@provenbatch.co.uk. We will acknowledge within 2 working days. We do not publish a fix-by date.

2.2 Please do not test the live Service without our prior written permission. Our Acceptable Use Policy forbids unauthorised security testing, including probing for vulnerabilities. This page is the channel for a finder to tell us, not an invitation to probe. A machine-readable copy of the same contact is at /.well-known/security.txt.

3. Controls that are in place

Each of the following is running today. None of them is a claim about a future control.

  • Your data is held in the UK. Account data and business content sit with Supabase in London (eu-west-2). The AI features that read photos or transcribe voice notes are the documented exception — they go to the United States, as the Privacy Policy already says.
  • One customer’s records cannot be read by another. Access is enforced by row-level security at the database, so a signed-in session only sees its own tenant.
  • Every server-side function checks who is calling. Functions that touch customer data identify the caller themselves before they do any work, rather than trusting the network alone.
  • Platform-admin access requires two-factor authentication. The operator console that can act across tenants will not accept a session that has not completed a second factor.
  • Admin writes are audit-logged. Changes made through the operator console are written to an audit log.
  • You can export your data at any time, and deletion has a 30-day grace. An export is available while the account is active and while it is in Archive. Asking us to delete the account starts a 30-day grace period; after that the data is erased.
  • Database advisors are checked weekly. A scheduled job reads the database security and performance advisors on both the live and staging databases.
  • Incidents are published at /status. When something is wrong, the status page is updated with what is affected and what we know.