Trust Center
Last updated: 21 October 2026
ProofMyAI processes conversations between businesses and their customers, so we built it to collect as little as possible and to give each business control over what is stored and where it goes. This page answers the questions a data protection review usually asks.
🏢 Who we are
ProofMyAI is operated by Muhammad Usman, sole proprietor, Pakistan. About us. Contact: contact@usmanabbas.dev.
For customer data you send us, you are the data controller and ProofMyAI is your data processor. Our Data Processing Agreement (DPA) sets this out under GDPR / UK GDPR Article 28 and can be accepted online.
🎛️ Controls you have, per project
- Masking before storage and AI checks (on by default): emails, phone numbers, card numbers, IBANs, IP addresses, UK postcodes, UK number plates, self-introduced names ("my name is …"), plus your own list of words (customer names, account numbers, internal codes).
- Results-only mode: keep verdicts, reasons and scores but never the conversation text.
- Automatic deletion after 7, 30, 90 or 365 days.
- AI provider off: checks run with rules and your own neural model only, so no data leaves ProofMyAI.
- Delete any time: audits, projects or your whole account, removed immediately from the live database.
- Upload instead of connect: audits can run on exported, anonymised files with no live connection to your systems.
- CRM and Google Sheets monitoring is read-only: ProofMyAI never writes to your CRM or sheet. From CRM records it keeps only one-way hashes of emails and phone numbers (to spot duplicates), filled/empty flags and timestamps, never names, emails or phone numbers, and deletes them after 180 days.
Masking is pattern-based. It greatly reduces personal data, but it cannot guarantee that every free-text detail is caught. For highly sensitive data, combine it with results-only mode, short retention, AI off, or self-hosting.
🌍 Where data is processed
- Application and database: Railway, US West.
- AI judge (only when on for a project): masked text is sent to the AI provider listed below, only for the check, over HTTPS. Anthropic does not train its models on data sent through its commercial API.
- Transfers outside the UK/EEA are covered by the safeguards in our DPA (EU Standard Contractual Clauses and the UK Addendum).
🤝 Sub-processors
| Company | Purpose | Data | Location | In use |
|---|---|---|---|---|
| Railway Corporation | Application hosting and database | All service data | US West | Yes |
| Anthropic PBC (Claude API) | AI judge, only for projects with AI checking on | Masked chat text, agent runs, help articles | United States | Yes |
| Resend, Inc. | Emails (alerts, summaries, password resets) | Account email, alert summaries | United States | Yes |
| Paddle.com Market Ltd | Payments and invoicing (Merchant of Record) | Billing name, email, payment details | United Kingdom | Yes |
Our public website also uses Google Analytics (visits only, never inside the dashboard) and YouTube for videos (loaded only when you press play). We give at least 30 days' notice by email before adding a sub-processor that handles customer data.
🔒 Security measures
- HTTPS for every connection; security certificates managed by our host.
- Passwords hashed with scrypt; login sessions stored only as hashes in secure, http-only cookies; sign out of all devices at any time.
- Integration secrets (n8n/Make keys, CRM, Intercom and Twilio tokens, bot headers) encrypted with AES-256-GCM.
- Every page and API call checks that the data belongs to the requesting account; API keys are per project and can be replaced instantly.
- Protection against requests to private networks (SSRF) for every outbound call, and rate limits on logins and the API.
- Administrator access is limited to the operator and every admin action is logged. Support staff never see API keys, and we only open a customer's conversations to help that customer, at their request.
- Personal data breaches are reported to affected customers without undue delay, and at most within 72 hours of us becoming aware.
🧪 Security & resilience, tested on every release
These behaviours are checked by automated tests that must pass before any change goes live (360+ tests in total). They show the protections work as designed; they are not an external penetration test or certification.
| Area | What the tests prove |
|---|---|
| Tenant isolation | A login or API key can never open, read or write another customer's project, approvals or traces; data sent with a key lands only in that key's project. |
| Outbound requests (SSRF) | Private, loopback, cloud-metadata and reserved addresses are blocked in every notation, before and while connecting, including DNS-rebinding tricks. |
| Credentials | Integration secrets are encrypted and tampering is detected; passwords are hashed; password resets are single-use and expire; resetting signs out every device. |
| Login protection | Two-factor codes match the RFC 6238 standard and work once; CAPTCHA can't be replayed; breached and weak passwords are refused; disposable emails are blocked; rate limits apply. |
| Approvals (retry safety) | Duplicate and simultaneous requests become one; rejected actions stay blocked on every retry; only the first of two simultaneous decisions counts; expired requests can't be approved; a failed callback never loses the decision. |
| Webhooks | WhatsApp webhooks need the project key; phone numbers are never used as conversation ids. |
| Privacy | Personal data masking (cards, emails, phones, postcodes, plates, names, custom words), results-only mode, AI-off mode and retention deletion. |
| Recovery | Every daily backup is restored into a scratch database and checked (integrity, row counts, encryption round-trip); the restore script recovers the data; a damaged backup fails the check. Result shown on the status page. |
| Detection quality | A regression guard keeps basic-mode accuracy on the public benchmark from getting worse. |
🛡️ Your AI integration stays safe
Our code snippets send data in the background with a 2-second limit, so monitoring can never slow down or break your chatbot or agent. Nightly tests should point at a test endpoint, never at a live WhatsApp/Twilio or SMS webhook.
🏗️ Self-hosted and enterprise
For dealerships, finance, healthcare and other regulated businesses, ProofMyAI can run on your own server or cloud account, so conversations never leave your infrastructure, with an AI provider of your choice or none. Ask about self-hosting.
📄 Questions and documents
Email contact@usmanabbas.dev for a signed DPA, a security questionnaire, or anything not answered here. See also our Privacy Policy and Terms.