Every material action remains bounded, visible and auditable.
Proconomy holds SOC 1 Type 2, SOC 2 Type 2 and ISO 27001, and processes personal data to GDPR. This page covers the product controls that sit alongside them: role-based access, agent permissioning, policy thresholds, human approval checkpoints, explainability, override and the action audit trail. Hosting locations, encryption specifications, retention periods and subprocessor lists are provided during enterprise review.
-
SOC 1
Type 2
Controls over financial reporting, tested over a period rather than at a point in time.
-
SOC 2
Type 2
Security, availability and confidentiality controls, tested over a period.
-
ISO 27001
Certified
A certified information security management system, audited against the international standard.
-
GDPR
Compliant
Processing, retention and data subject rights handled to the regulation.
What is verified and can be demonstrated
These controls are product features rather than policy statements, which is why they can be shown in a demonstration rather than described in a questionnaire response.
- Role-based access control across users and agents, scoped by entity and category.
- Agent permissioning: defined permitted actions, value limits and escalation paths.
- Executable policy and threshold controls.
- Human approval checkpoints that agents cannot bypass.
- Segregation of duties applied to agents as well as to users.
- Explainability for every material automated action.
- Override by authorised roles, with the reason recorded.
- A complete, retained action audit trail.
- Role
- Who may act in this entity, plant and category
- Permission
- Which specific actions an agent may perform
- Threshold
- The value or risk level at which a person must decide
- Policy
- The buying route required for a category or entity
- Approval
- Sequential, parallel and conditional decision points
- Checkpoint
- Where execution pauses and waits for judgement
- Exception
- What happens when a rule cannot be satisfied
- Override
- Who may authorise a departure, and on what record
- Audit
- The retained history of every action and decision
What you can see now, and what comes with review
Product controls are demonstrable on request. Infrastructure and contractual detail goes to your security and data-protection teams under review, where they can question it properly.
| Topic | Status |
|---|---|
| Identity and access controls | Documented as product capability. Role-based access applies to users and agents and can be demonstrated. |
| Agent permissioning and boundaries | Documented as product capability. Each agent has an explicit permitted-action set. |
| Human approval and segregation of duties | Documented as product capability. Checkpoints cannot be bypassed by an agent. |
| Audit trail and evidence retrieval | Documented as product capability. Retention periods are configured per customer. |
| Responsible AI and explainability | Documented as product capability. Material actions carry a retained explanation. |
| Security certifications | Evidenced directly to your security team during enterprise review. |
| Hosting and data location | Confirmed with your architects during scoping and contract review. |
| Encryption specifications | Supplied in the security documentation your review team receives. |
| Data retention periods | Configured per customer, to your policy rather than to a fixed default. |
| Subprocessor list | Supplied during contract and data-protection review. |
| Business continuity | Supplied in the security documentation your review team receives. |
| Security contact | Use the contact form and mark it a security review request. It routes straight through. |
Security, hosting, encryption, retention and subprocessor detail is handled through enterprise review, where your security and data-protection teams can question it directly. Tell us what your review process needs and we will work to it.
What to ask us to demonstrate
If your security or internal audit function is assessing software that will execute work, these six requests are the fastest route to a decision.
- Show the permission set for one agent in the configuration.
- Show an action being blocked at a threshold, with the rule that blocked it.
- Show an escalation reaching a named approver with the reason attached.
- Show an authorised override and the record it leaves.
- Retrieve the complete action history for a single transaction.
- Show how a change to policy or permissions is itself approved and recorded.
Bring your security and audit colleagues to the first demonstration.
Evaluations of software that executes work move considerably faster when the governance conversation happens at the start rather than at contract stage.
Someone from client success replies, not a sales sequence. If we are not a fit we will say so on the first call.
Not ready to talk to anyone?
Fair enough. Both of these work without giving us your email.