Security and accountability are the default, not a tier.
Everything we build runs on one platform, so every security decision is made once and applies to every application. This page says what those decisions are. If your compliance team wants the detail behind any line, ask.
Made once, applied everywhere.
Every change is on the record
Every change to every record is written to an audit history: what, who, why, when. No silent updates anywhere. Business state is derived from that history, so it cannot drift from it.
Access starts empty
Deny by default. Every list, dropdown, report, search result and API response starts as an empty set and includes only what the viewer is entitled to see. Enforced at the query and re-checked in every endpoint.
Two-factor authentication
Mandatory for every member of Prolink staff. Available to every client user, with trusted browsers, recovery codes and session control. Any session, web or phone, can be revoked from one place.
Your data, in its own place
Secrets encrypted at rest. Each client's files in isolated cloud storage with its own credentials, so isolation is enforced by infrastructure rather than application code. Every file served through a short-lived signed link. UK hosting.
Email you can trust
Transactional email through Postmark with per-client branding, so a message from your application looks like it came from you.
We usually see a fault before you do
Central error tracking and an activity timeline across every application. A failure alerts us; a repeated failure raises a digest, never a flood.
A continuity plan, in writing
Every client receives a written Disaster Recovery and Business Continuity plan for their application, generated from a maintained master and kept current. Prolink's own estate rebuilds from source control with a tested runbook.
On the phone
Prolink Mobile holds one credential, the person's own token, in the device's secure store. No app secret in the binary. Device sign-ins are scoped to one application and revocable alongside web sessions.
What we do not claim
No e-signature of contracts yet; quote acceptance is recorded with name, email, IP address and time. No payment taking on the platform; invoices are paid in Xero. No SRA client-account accounting yet. No self-service sign-up, by choice.
Send this page to your compliance lead.
We will answer their questions in writing, with the detail behind each line.
0800 246 1101 · hello@prolink.io