This page describes how we protect your data on the Pragmon AI platform. It is Annex II of the Pragmon AI Data Processing Agreement (pragmon.ai/legal/dpa). To report a security concern, or to ask a question about our security, write to contact@pragmon.ai.
Where your data is kept
Your data is stored with Railway, our hosting provider: the database, the files you upload and the outputs we produce for you. The websites you use to reach the platform run on Vercel. Every company that processes your data for us is listed on our Subprocessors page (pragmon.ai/legal/subprocessors).
Encryption in transit
Every connection between your browser and the platform is encrypted with TLS 1.2 or later. The platform refuses unencrypted connections, and tells browsers to use only encrypted connections to it for a year at a time.
Keeping each customer's data separate
Every request for customer data is checked against the user's membership of that company. A user can see only the data of the companies they belong to. A request for another company's data returns "not found", so it does not even reveal that the data exists.
Signing in
- Users sign in with a password or with a single-use link sent by email. A sign-in link expires after 15 minutes and works once.
- Passwords must be at least 10 characters. Common passwords, all-number passwords and passwords too close to a user's own details are refused.
- We never store passwords. We store only a one-way hash, made with PBKDF2-SHA256.
- Repeated failed sign-in attempts from one address are blocked for a period. Requests for sign-in links and password resets are limited too.
- A signed-in session lasts at most 12 hours, then the user signs in again. Session cookies are sent only over encrypted connections and cannot be read by scripts on the page.
Records of activity
- We record every sign-in, sign-out and failed attempt, with the time, network address and browser. We keep these records for 13 months.
- We record when reports and briefs are opened or exported, and when our staff change a customer's settings. We keep these records for 13 months, then delete them automatically.
- Before our server logs reach our log service, we remove passwords, sign-in tokens, cookies, keys and email addresses from them.
Keeping data no longer than needed
- Accounting files you upload for a performance review are deleted as soon as the review run that reads them ends, whether it succeeds or fails. The figures we derive from them stay with your review.
- Each subprocessor receives only the data it needs for its job.
- Product analytics on the customer platform do not identify a user until that user accepts the analytics consent banner.
AI models and your data
We do not train AI models on your data. The providers of the AI models we use process it under their own commercial terms, listed on our Subprocessors page.
Connections to your accounting system
Where you connect your accounting system to the platform:
- We store the password for that connection encrypted. The platform refuses to store it at all if the encryption key is missing.
- The platform never displays a stored connection password, to anyone.
- The platform connects only to public network addresses, so a connection cannot be used to probe our internal network.
- Where you run our connector inside your own network, it only makes outbound calls to us. Nothing on your network has to accept a connection from outside. Each connector has its own access token. We store only a one-way hash of it, it reaches one company's data only, and we can revoke it at once.
- The connector runs only queries that read data. It never runs queries that change your records.
Our own systems
Passwords and keys for our systems are kept in our hosting providers' secret stores, never in our source code.
If something goes wrong
If a security incident affects your personal data, we tell you within 72 hours of becoming aware of it, as our Data Processing Agreement sets out.