Security is the product
ProofCap handles sensitive financial and traffic data on behalf of buyers and sellers. Here's how we protect it.
Read-only OAuth scopes
ProofCap connects to Stripe and Google Analytics using read-only OAuth scopes. We cannot create, modify, or delete data in your accounts — we can only read the figures needed to run an audit.
Encryption everywhere
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. OAuth tokens are encrypted with AES-256-GCM before being stored in the database, and are never logged or exposed in API responses.
Infrastructure: Supabase (SOC 2 Type II)
ProofCap runs on Supabase, which holds SOC 2 Type II certification. ProofCap itself is not yet independently SOC 2 certified — we are targeting our own Type II audit by Q1 2027. We will update this page when completed.
Data minimization & retention
We store only the data required to generate and reproduce your audit reports. Raw billing exports are not retained beyond what's needed for the audit pipeline, and you can request deletion at any time.
Integrations
Exactly what we access
For every integration, below is the exact OAuth scope we request, what we read, what we store, what we explicitly cannot do, and how to revoke access.
Stripe
read_only (Stripe Connect OAuth scope)What we read
Charge events, subscription records, refund history, payment method domains — used to compute verified MRR, churn rate, and revenue plausibility.
What we store
Encrypted OAuth access token and account ID. Computed aggregates (MRR, charge count, refund rate) stored in the audit report. Raw transaction records are not persisted.
What we cannot do
Cannot create charges, modify subscriptions, issue refunds, or access customer PII beyond what is necessary for aggregate computation.
How to revoke
Stripe dashboard → Settings → Connected applications, or from your ProofCap dashboard settings.
Google Analytics (GA4)
https://www.googleapis.com/auth/analytics.readonlyWhat we read
Session counts, engagement rate, bounce rate, new users, page views, and channel breakdown for the 90-day window used in the audit.
What we store
Encrypted OAuth access token and refresh token. Computed traffic aggregates stored in the audit report. Raw event-level GA4 data is never stored.
What we cannot do
Cannot modify GA4 properties, create or delete views, or access any Google account data outside of the Analytics Read API.
How to revoke
Google Account → Security → Third-party apps with account access, or from your ProofCap dashboard settings.
Lemon Squeezy
API key (store-scoped, read operations only)What we read
Orders, subscriptions, and store metrics for the connected store — used to compute verified revenue figures.
What we store
Encrypted API key. Computed revenue aggregates stored in the audit report. Raw order records are not persisted.
What we cannot do
Does not issue refunds, modify products, or access data outside the connected store.
How to revoke
Lemon Squeezy dashboard → Settings → API, or delete the key directly and update your ProofCap audit.
Account & Access
How access is controlled
Authentication. Passwords are hashed using industry-standard algorithms and are never stored or transmitted in plaintext. We support email-based verification for new accounts and password reset flows that expire after a short window.
Disconnecting integrations. You can revoke ProofCap's access to your Stripe or Google Analytics accounts at any time, either from the ProofCap dashboard or directly from your Stripe/Google account settings. Revoking access immediately stops any further data collection.
Internal access. Access to production systems and customer data is restricted to a small number of engineers and is logged. We do not access customer data except to provide support or investigate a reported issue.
Roadmap
What's coming
We publish what we're working toward so you can hold us accountable.
SOC 2 Type II
ProofCap itself (not just our infrastructure provider) will be independently audited against the SOC 2 Trust Services Criteria over an observation period, targeting report completion by Q1 2027.
Third-party penetration test
An independent penetration test of the ProofCap application and API surface, targeting completion by Q1 2027. A results summary will be published after remediation.
Application-level token encryption
OAuth tokens (Stripe, Google Analytics) are now encrypted with AES-256-GCM at the application layer before being written to the database, in addition to database-level encryption at rest.
Responsible Disclosure
Found a vulnerability?
If you believe you've found a security issue in ProofCap, please report it to us privately so we can investigate and fix it before any public disclosure.
How to report. Email [email protected] with a description of the issue, steps to reproduce, and any proof-of-concept. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and respond (we aim to acknowledge within 72 hours).
In scope. proofcap.io and all subdomains, ProofCap API endpoints, OAuth integration flows, authentication and session handling, data access controls.
Out of scope. Social engineering, physical attacks, denial-of-service, issues in third-party services (Stripe, Google, Supabase) that are not caused by ProofCap's integration, and issues without a plausible security impact.
Safe Harbor — [TODO: legal review before publishing]
We will not pursue legal action against researchers who discover and report security vulnerabilities in good faith, provided the research does not involve accessing, modifying, or deleting data belonging to other users; does not disrupt ProofCap services; and is reported to us before any public disclosure. We consider good-faith security research to be authorized under this policy.