Security · Prospen

Hosting and transport

The application and this site run on Vercel. Every request is served over HTTPS with TLS, and HTTP requests are redirected. Vercel operates the underlying infrastructure and its own security controls.

Data minimisation

We store the account email, the brand profile and knowledge you give us, the runs and partner lists your account produced, and the outreach you approve and the replies it gets. That is what the product needs. Card details go to Stripe and never touch our servers, and we do not build a profile of you beyond your own account.

Credentials for your other tools

Prospen never asks for a password to another service. Where it connects to one, it uses that provider’s own authorisation flow, with the scopes shown before you approve, and you can revoke access from your side at any time.

Google Drive. Scope drive.file only, so Prospen can read the files you pick in Google’s picker and nothing else. The token is stored encrypted and is unreadable to the application layer without the sealing key.
Sending mailboxes. Connected through our sending provider, by Google or Microsoft sign-in or by SMTP and IMAP details you enter in its window. Prospen holds a reference to the connection, not the mailbox password.
API keys and the MCP server. Personal keys are shown once and stored hashed. Each key acts within its owner’s role, and every remote action is written to an audit log.
The Chrome extension. Sends Instagram and TikTok messages from the account you are already signed into in your own Chrome. It never sees that password, cookie or session; it holds only a pairing key for your workspace that you can revoke from the app.

Access control inside Prospen

Every table is scoped to your organisation by row-level security in the database, and the browser only ever holds a key that is subject to those rules. Roles (owner, admin, member, viewer) decide who can approve, send, bill and invite. Staff access to accounts goes through a separate internal dashboard that is restricted to the team operating Prospen and audited.

A human approves before contact

Nothing is sent to a partner on your behalf without your explicit approval. Outreach goes from your own connected mailbox, with daily sending limits, an unsubscribe header, a never-email list, and a stop the moment someone replies.

What we do not claim

No SOC 2, no ISO 27001, no penetration-test report. We have not done them yet. If a certification matters to your procurement, tell us where you need to get to and we will tell you honestly whether we are there.

Reporting a vulnerability

Email hello@prospen.ai with the subject “Security”. Tell us what you found and how to reproduce it. We will acknowledge within one business day, keep you updated, and will not pursue anyone who reports in good faith and does not access other people’s data.

Data protection paperwork

Our Data Processing Addendum applies to every customer automatically, the providers that process data for us are listed on the subprocessors page, and the Privacy Policy says what we hold and for how long. We answer one written security questionnaire a year per customer.

What we hold, and what we deliberately do not