Trust centre
Trust & security
What a compliance or procurement reviewer needs before integrating, in one place. We list only what we can evidence today and we show the gaps. Prometiam is based in Barcelona, Spain.
Last updated: October 24, 2026
Status and uptime
External monitors check the authenticated API and publish their history on the public status page. Target: 99.5% availability a month on self-serve plans. A target, not a guarantee.
Monitoring began on 13 October 2026, so the history is still short. Incidents are posted there as they are found, with updates until they end.
Status board
Each line says where we stand: In place, Partial, Not yet, Not started or Not offered. “To confirm” marks a fact we have not evidenced yet, so we do not claim it.
| Area | Status | Where it stands |
|---|---|---|
| EU data residency | In place | Accounts, keys, usage and billing are in Frankfurt; the company data is on a dedicated server in Germany. No database replication outside the EU. |
| Keys and access | In place | API keys are stored only as SHA-256 hashes and shown once. Row-level security protects customer tables. Admin actions need a verified session plus a step-up and are logged. |
| GDPR | In place | Records of processing, a published data processing agreement and a legitimate-interest assessment for register data about officers and owners. This is not a certification. |
| Card data (PCI DSS) | In place | Card payments are handled entirely by Stripe. Prometiam never sees or stores card data. |
| Vulnerability reports | In place | A security mailbox and a published security.txt. We acknowledge a report within three business days. |
| Breach notice | In place | The DPA commits us to tell customers, without undue delay and within 72 hours, of a personal data breach affecting their data. |
| Service levels | Partial | A target of 99.5% availability a month, measured on the public status page, and e-mail support with a first answer within one business day. Targets, not guarantees. |
| Service credits and phone support | Not offered | Not on self-serve plans. Enterprise agreements can add service credits, higher targets and named support contacts. |
| Independent penetration test | Not yet | None yet; our reviews are internal. |
| SOC 2 | Not started | No report and no auditor engaged. |
| ISO 27001 | Not started | Not certified and not under way. |
| Encryption at rest | To confirm | Not claimed until we can show the evidence. |
| Backups and restore test | To confirm | Not claimed until we can show the date of a restore test. |
| Recovery targets | To confirm | Recovery time and recovery point targets are not published yet. |
| Business continuity | To confirm | Continuity arrangements are not published yet. |
| Insurance | To confirm | Professional liability and cyber cover are not published yet. |
Next steps and dates: Dates for assurance steps such as a first independent penetration test, evidence for encryption at rest and a restore test are to confirm. We publish a date here only once it is committed.
Data flow
Where customer API inputs travel. Built only from what the sub-processor list, the DPA and the service levels already state.
Your system
Sends API requests: company searches, screened names, monitoring lists and webhook endpoints.
API service
Supabase, EU (Frankfurt). Runs the API; holds accounts, keys (as hashes), usage and billing records.
Company data
OVHcloud, EU (Germany). Dedicated server for the register data, insolvency notices and sanctions lists, and for your monitoring lists and screened names.
Who can see customer API inputs
Yes
Supabase and OVHcloud: they run and store the service.
Limited
Anthropic and Telegram: only what a support message or an internal alert contains, such as a customer e-mail address or a company name.
No
Cloudflare, Stripe, Zoho, Better Stack, the language-model providers of the website assistant and ipwho.is: they handle website visitors, billing, e-mail or monitoring probes.
Some sub-processors (Cloudflare, Stripe, Anthropic, Telegram) process data outside the EEA under the Standard Contractual Clauses. Customers get 30 days’ notice before a change.
Resilience and exit
Availability
99.5% a month is the self-serve target. Announced maintenance and outages of an upstream register are not counted: the data then ages until the source returns, and freshness is shown per country.
Data freshness
We check data freshness daily.
Your keys
Revoke or rotate any API key from the dashboard, with an overlap while you switch over.
Your records
Export your request log as CSV and a company file as JSON from the dashboard before you leave.
Deletion
On termination we delete your monitoring lists, webhook endpoints and stored screening inputs, and account data not covered by a retention duty, within 30 days. Ask for an export first (DPA, section 9).
No lock-in
Plain REST and JSON with a public OpenAPI file. Cancel at any time under the Terms.
Incident response
Report
Send security reports to security@prometiam.com. We acknowledge within three business days.
Notify
A personal data breach affecting your data is notified to you without undue delay and within 72 hours of our becoming aware of it, with what we know and the measures taken.
Update
Incidents are posted on the status page as they are found, with updates until they end. Planned maintenance is announced in advance.
To confirm A written post-incident review shared with affected customers.
Security controls
| Control | What it is |
|---|---|
| API keys | Stored only as SHA-256 hashes. A new key is shown once; the temporary copy that lets the owner re-display it is encrypted and deleted after 72 hours. Keys are revocable and rotatable from the dashboard. |
| Row-level security | Customer tables are protected by row-level security; the company-data schemas are not exposed to the public database API and are reached only by the API service itself. |
| Sign-in | Password plus an emailed login code (stored as a keyed hash); lockout after repeated wrong passwords; leaked-password protection and a 12-character minimum; sessions end after two hours without activity and eight hours at most. |
| Account change alerts | Every password or e-mail address change is mailed to the previous address; reset tokens are stored hashed and a reset signs out every session. |
| Abuse limits | Free-trial sign-ups are rate-limited per IP address and e-mail domain; the API enforces per-minute and monthly limits per account. |
| Payments | Stripe webhooks are signature-verified and processed once. |
| Administration | Admin actions are gated by a verified session and an additional step-up, and written to an audit log. |
| Transport and headers | HTTPS with HSTS and security headers on the website; TLS to the databases; key-only SSH on our own server. |
| Disclosure | A published security.txt and a security mailbox (below). |
Document library
| Document | Version | Access |
|---|---|---|
| Data processing agreement | October 13, 2026 | Published; a countersigned copy on request |
| Sub-processors | October 24, 2026 | Published |
| Service levels | October 13, 2026 | Published |
| Privacy policy | October 13, 2026 | Published |
| Terms | October 14, 2026 | Published |
| Security contact file (security.txt) | — | Published |
| Public status page | — | Live |
Due-diligence pack
Ask for the pack and we send what exists today and say plainly what does not. Each item shows its status.
- Published Data processing agreement, sub-processor list and service levels
- To confirm Security overview
- To confirm Architecture and data-flow document (PDF)
- To confirm Answers to vendor questionnaires (SIG Lite, CAIQ)
- Not yet Penetration test summary
- To confirm Source and licence register
Where the data comes from
Company data is sourced from official national registries in 36 countries — BORME (Spain), BODACC and the RNE (France), Companies House (United Kingdom), the CRO (Ireland), the KRS (Poland), Enhetsregisteret at Brønnøysundregistrene (Norway, open data under the NLOD licence), the Kaupparekisteri, the Finnish Trade Register (Finland), Bolagsverket, the Swedish Companies Registration Office, with activity codes from Statistics Sweden (Sweden), the Sudski registar, the Croatian court register (Croatia), the Crossroads Bank for Enterprises, the Belgian register of enterprises (Belgium), the Central Business Register (CVR), run by the Danish Business Authority (Denmark), the e-Business Register (Äriregister), run by the Centre of Registers and Information Systems (Estonia), the Register of Legal Entities (RPO), run by the Ministry of the Interior of the Slovak Republic (Slovakia), and Zefix, the central business name index of the Federal Office of Justice (Switzerland), the Register of Enterprises of the Republic of Latvia with the State Revenue Service VAT payer list (Latvia), and for the United States (US sources: New York Department of State, Colorado Secretary of State, Connecticut Secretary of the State, Pennsylvania Department of State (open data), Florida Department of State, Division of Corporations (public records), Iowa Secretary of State (CC BY 4.0), District of Columbia Department of Licensing and Consumer Protection (CC BY 4.0), Texas Comptroller of Public Accounts (franchise tax data), Oregon Secretary of State, Corporation Division (open data), Massachusetts Secretary of the Commonwealth, Corporations Division (public-record extract of 19 Oct 2026; not an official register extract and not endorsed by the Secretary), SEC EDGAR, GLEIF (CC0)), and registers in Lithuania, Canada, Australia, Japan, Israel, Brazil, Colombia, Singapore, Taiwan and the Czech Republic (open-data publications, credited as the API returns them). Sanctions and export-control data is consolidated from EU, UN, OFAC, the UK Sanctions List (FCDO), French gels des avoirs, the Australian DFAT Consolidated List (Source: Department of Foreign Affairs and Trade website – www.dfat.gov.au (Australian Sanctions Consolidated List), licensed CC BY 4.0. Adapted by Prometiam.) and the US Consolidated Screening List. Sanctions screening is currently labelled beta.
PEP screening is available in beta, Spain only, via ?include_pep=true. It is derived from Wikidata occupation data rather than office records — 44% of the set has no recorded office, and it contains no relatives or close associates (RCAs) — so it does not on its own satisfy a FATF PEP screening obligation. We do not provide natural-person identity or document verification, or adverse-media screening. If you need full PEP/RCA coverage or adverse media, pair Prometiam with a dedicated screening vendor.
Questions we are asked most
Do you have SOC 2 or ISO 27001?
No. SOC 2 is not started and ISO 27001 is not under way. We would rather say so now than have you find out in week three of an evaluation.
Where is our data held?
In the EU. Accounts, keys, usage and billing are in Frankfurt; company data and your monitoring lists are on a dedicated server in Germany.
Do you keep the names we screen?
Monitoring lists, webhook endpoints and stored screening inputs are kept to run the service and deleted within 30 days of termination (DPA, section 9).
Can we have a countersigned DPA?
Yes. The published DPA applies by using the service; a countersigned copy is available on request at support@prometiam.com.
Who do we contract with?
The contract facts we can state today are on the Enterprise page. See the Enterprise page
Reporting a vulnerability
Email security@prometiam.com. Please include steps to reproduce. We will acknowledge within three business days. Please do not run automated scans against production or access data that is not yours.
Privacy, DPA & data subject requests
Our Data Processing Agreement is published and accepted by using the service; a countersigned copy is available on request at support@prometiam.com. Data-subject requests and the full processing detail are covered in the privacy policy; the basis for serving officer and owner data is a legitimate-interest assessment kept on file.
About Prometiam and how the data is checked
Who is behind the service is on the About page. How the sources are checked, how fresh each dataset is kept and what each limit means is on the data assurance page.