Prufy platform privacy policy

For any question about your data, write to hello@prufy.io.

Prufy is a platform for organisations. Your organisation gives you access and decides what is audited and what data is uploaded. That is why there are two roles:

• Prufy is the controller of your account data and security logs: what we need to let you in, know which organisation you belong to and protect the platform. This policy is about that data.
• Your organisation is the controller of the audit content: projects, notebooks, documents, files, tests, findings, reports and the people who appear in them. Prufy processes it as a processor, following its instructions and the data processing agreement we sign with it. To exercise your rights over that content, contact your organisation; if you write to us, we will pass your request on.

• Account identity, received from the provider you sign in with: Google or Microsoft (Microsoft Entra ID, both work or school accounts and personal Microsoft accounts). We only request the basic sign-in permissions (openid, email and profile). We receive your account's stable identifier (for Microsoft, together with your organisation's directory identifier), your name, your email and whether the provider has verified that email (for Microsoft work accounts, whether the email domain is verified). We only use them to authenticate you: we store the identifier and the verified email; the name we receive is not stored, and the name shown is the one in your Prufy profile. We never receive or store your password.

• Session: when you sign in we create a session. In the database we only store a cryptographic hash of its identifier, your identity, the provider, your email and the start, last-activity and expiry times. The session expires after 12 hours of inactivity and, in any case, after 7 days.

• Membership and role: which organisation you belong to, your role (Administrator or Auditor), the related permissions and the status of your access (active, suspended or revoked).

• Invitations: your email, the organisation and role you are invited to, who invited you, the expiry date and the status of the invitation. If your organisation invites you, we send you an email with the access link.

• Last access: the date and time of your last activity in each organisation, which that organisation's members see on the People screen.

• Activity and security logs: what action was taken, on which item, by whom and when (for example, creating a notebook, reviewing a result, inviting or revoking a person), and technical logs of requests to the service.

• Technical cookies, strictly necessary for the service. All are first-party cookies of app.prufy.io (__Host- prefix, sent only over secure connections and not accessible to page scripts):

  Cookie	Purpose	Duration
  __Host-prufy-session	Keeping you signed in (random session identifier)	Up to 7 days; deleted when you sign out
  __Host-prufy-oidc	Temporary state of sign-in with Google or Microsoft (single-use random values to check the provider's response)	10 minutes; deleted on return from the provider
  __Host-prufy-org	Remembering the organisation you are working in	1 year
  __Host-prufy-alta	Only when enrolling the first owner of an organisation: a short fingerprint that lets Prufy confirm the enrolment	10 minutes

  The platform does not use analytics, advertising or third-party cookies.

• Browser local storage: the platform keeps technical preferences (such as the theme or the sidebar state) and unsaved drafts in your browser. They are not sent to Prufy on their own and you can delete them from your browser.

We do not take automated decisions with legal effects on you. The platform's AI proposals are drafts: final validation rests with the auditor.

We rely on providers acting as processors: Google Cloud hosts the platform in Belgium (europe-west1); Google Workspace sends the invitation emails; and, when you use the AI assistant, OpenRouter routes the request to the Anthropic Claude model, which runs on Google Vertex AI. The full list, with locations, is provided to each customer organisation and to anyone who asks at hello@prufy.io.

The provider you sign in with (Google or Microsoft) processes your data as an independent controller, under its own terms. It only shares with us the data in section 03, which we only use to authenticate you.

We do not sell your data or share it with third parties for their own purposes. We will only disclose it to authorities when the law requires it.

The platform, its database, its files and its backups are hosted in the European Union. The service's technical logs (Google Cloud Logging) are stored in Google's global location, which is not pinned to the EU. Some providers are established in the United States or may process data there:

• OpenRouter, Inc. (United States) receives the content of each AI request and routes it to the model, which may run outside the EEA. On every request we ask it to use only providers that do not retain or use the data (data_collection: deny and zdr). This transfer relies on the European Commission's standard contractual clauses.
• Google may process data outside the EEA for some support services and for the globally located technical logs; those transfers rely on Google's standard contractual clauses.

Your account data is not sent to the AI model: the model only receives the content needed for each request, with email addresses masked and known subjects pseudonymised, without your identity or any user identifier.

• Account, membership and role: while you have access to any organisation. When your organisation revokes your access, your account can no longer sign in and we keep a record of the revocation with the activity log.
• Invitations: invitations to the organisation expire after 30 days if not accepted, and those to a specific notebook after 7; we keep a record of them with the activity log.
• Activity logs: while the contract with your organisation is in force, because they are part of the traceability of its audit work, and they are deleted with the rest of its data when the return period ends. We will only keep, blocked, the security logs needed to handle possible claims, for the limitation period of the corresponding actions.
• Sessions: they expire after 12 hours of inactivity or after 7 days at most; expired sessions are removed the next time you sign in.
• Technical service logs (Google Cloud Logging): 30 days for ordinary logs; 400 days for the audit logs that Google keeps mandatorily (a period set by Google).
• Backups: the database takes an automatic backup every day and keeps the 14 most recent, plus the transaction logs needed to restore it to any point in the last 7 days. An additional on-demand backup is taken before every change to the database structure.

You can access, rectify and erase your data, object to or restrict its processing and request its portability by writing to hello@prufy.io. If your data is part of an organisation's audit content, the response is that organisation's and we will pass your request on. Note that while you remain a member, we need your account data to give you access.

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

The platform applies proportionate technical and organisational measures: data hosted in the EU (except technical logs, which are stored globally) and encrypted at rest and in transit, access only for invited people, isolation of each organisation's data in the database, least-privilege permissions by role and activity logging. Details are in Annex II of the data processing agreement.

If this policy changes, we will publish the current version here with its update date. Relevant changes will be communicated through a visible channel.