Keep your data secure and compliant

For documents, photos and attachments that users upload, Procore leverages Amazon Web Service's (AWS) highly secure data centers, S3 (Amazon Simple Storage Service). Amazon Web Services provides enterprise-class tools that have been proven to be both reliable and secure for today's web-based applications.

Procore employs many of the same data encryption standards, which are widely used by large online banking services. Data at rest is encrypted and stored behind Procore’s firewalls in a secure, private cloud infrastructure. 

Procore's network security architecture relies on the Transport Layer Security TLS v1.2 protocol for ensuring user interaction with Procore over the internet occurs securely without transmissions being vulnerable to outside entities. For data in transit, Procore encrypts data with 256-bit encryption. Data flowing between Procore and the user is encrypted with HTTPS protected by Transport Layer Security (TLS) 1.2. The primary benefit of TLS is the protection of web application data from unauthorized disclosure and modification when it is transmitted between clients (web browsers) and the web application server, and between the web application server and back end or other non-browser based enterprise components.

Procore maintains a robust “high-availability” strategy to protect our customers against software problems, hardware failure, and even large-scale natural disasters. Procore maintains several replicas of the application software on each server. All data are copied to off-site storage every 20 minutes. Replication distributes this offline snapshot across the United States. We maintain the software on dozens of servers and remote copies are maintained in different secure data centers. This diversity protects against hardware failure and local service issues.

Procore employs what many consider the industry standard for API authentication - OAuth 2.0. The OAuth 2.0 authentication framework provides a secure means of authorizing and authenticating access to user data for third-party applications. OAuth 2.0 relies on SSL (Secure Sockets Layer) to ensure data transfer between the web server and browsers remains private and is kept safe. OAuth 2.0 protects Procore user data by providing access without revealing the identity of the user. Third-party applications make requests on behalf of the user without accessing passwords and other sensitive information.

Any data being transferred is encrypted, which means the information is converted to a code that can only be understood at the other end, at its intended destination. Procore follows some of the strongest industry standards for encryption. We use firewalls, which block unauthorized access to information while enabling outward communication. Data is encrypted when it is stored on servers, as well.

Ensuring access to business information is one of the greatest benefits to using a cloud-based service. Backup copies of information are kept in alternate locations in case of a disaster, which is known as redundancy. And the software is scanned for any anomalies to detect coded threats, without actually reading the information. We have a dedicated team to monitor and respond to network threats, rather than a customer trying to do it all on their own. Procore has a set of procedures to follow called an Incident Response Plan to help ensure business continuity to our users.

First, there are IT security management standards, which you could compare to the kinds of standards you see around building or manufacturing. (ISO) 27001:2013 Is a framework for confidentiality, integrity and availability of information as well as legal compliance. SSAE18 SOC 2 Speaks to how we maintain confidentiality and security of data. Procore also engages third parties to review our program through an exercise called Penetration and Vulnerability Testing, as well as auditing and ensuring compliance with a number of industry standards. Next, Procore helps Customers meet their data protection regualtory requirements around what personal information can be collected, how it can be used, and who can access it.