How ImProHQ protects your data

ImProHQ is a cloud SaaS platform hosted entirely on Amazon Web Services. Your deployment's AWS region is agreed during implementation; your data is stored and processed in that region. Canadian data residency (AWS ca-central-1) is available for clients with Canadian residency requirements, subject to AWS service availability in the region.

Yes, both in transit and at rest. All traffic between users and the platform runs over HTTPS with TLS 1.2 or higher, and the same encryption protects traffic between platform components. All stored data is encrypted with AES-256, covering the database, document storage, and backups.

Client separation is enforced at the database layer, not just in application code. Every database query runs under row-level security policies enforced by the database engine, so it can only ever return your organization's data. This holds independently of the application code above it, giving defense in depth rather than a single point of failure.

Within your environment, what each of your own users can access is controlled by role (Q13).

Yes. Every change is recorded with who made it, what changed and when: record edits, approvals, status changes and other user actions.

The audit trail is append-only. It cannot be edited or deleted by anyone, including ImProHQ administrators; the database itself rejects any attempt. For processes like inspection acceptance and sign-offs, this gives you a complete history you can rely on.

You do. Documents, records, reports, attachments, extracted data and anything else you upload or generate in ImProHQ remain your property. Joras Technologies owns the platform and its software; using the platform transfers no ownership of your data to us.

Your data is treated as confidential and used only to deliver the service to you. The only third parties that process it are the subprocessors required to operate the service (Q18), each bound by the same confidentiality and data-protection obligations.

Deliberately little; we practice data minimization. The platform stores user account details (name, work email) and whatever personal information appears inside your business documents, for example inspector names, signatures and certification numbers on inspection reports. That information is protected by the same encryption, tenancy isolation and access controls as all other client data, and is processed only to deliver the service. For Canadian clients, we support compliance with PIPEDA and provincial privacy laws.

On termination or expiry, your data is available for export in usable, standard formats (structured data plus your original documents) for 30 days. After the export window it is securely deleted from production systems, and from backups as the backup rotation cycle completes. You can also export your data yourself at any time during the subscription.

ImProHQ is built on a constellation of enterprise-grade AI models: frontier models (the family behind tools like ChatGPT and Claude), open-weight models, and models fine-tuned for specific workflows. We select the best model for each task, and every model must meet the same bar before it processes client data:

• No training. Your inputs and outputs are never used to train the model.
• Zero data retention. Data is used to process the request and is not retained by the model company.
• Independently certified. SOC 2 Type 2, ISO 27001 and ISO/IEC 42001, the AI management standard; see trust.openai.com, trust.anthropic.com and aws.amazon.com/compliance.
• Enterprise access only. Models run through business services or inside our own AWS environment. Client data never touches free or consumer AI apps such as the public ChatGPT.

No, never. The AI model companies cannot train on your data (Q8), and we do not use your data to train models that benefit any other company. Your documents, prompts, extraction rules and configurations stay inside your environment, and one client's information is never used in another client's AI features. This is a design principle of the platform.

The AI model companies publish this commitment themselves: OpenAI's enterprise privacy page and Anthropic's privacy center both state that business customer data is not used to train their models.

Where we fine-tune a model on your data, for example extraction tuned to your report formats, the model is trained and hosted on AWS Bedrock inside our own AWS environment, and it serves only you. AWS Bedrock's data protection commitments state that customer content is not used to train the underlying models and is never shared with model providers.

Only the information its task needs. When AI processes an inspection report, it reads that report and the reference data configured for that workflow, nothing more. Each request carries the minimum data required: the principle of least privilege, applied to AI.

AI operates inside the same boundaries as everything else on the platform: your environment only, under the same database-enforced isolation (Q3). There is no shared AI memory or knowledge base spanning clients.

It can, and we design for that. No AI output reaches a decision without passing through checks that are not AI:

• The AI only extracts. It reads a document and fills the fields defined for the workflow. Every value is stored beside its source document, so checking any value takes one glance.
• Deterministic rules verify. Extracted values are validated against your business rules and reference data by conventional software: same input, same result, every time.
• Your people decide. Anything that fails a check, is missing or looks uncertain goes to your subject-matter experts. Nothing is auto-approved.

Extraction accuracy is measured against your real documents before a workflow goes live, and every AI value and human correction is in the audit trail (Q4). Accuracy also improves over time: the corrections your reviewers make are used to tune extraction for your document formats and your use case, and any model tuned on your data serves only you (Q9).

Yes, per work process. AI can be enabled, restricted or turned off for each work process independently, so you adopt it at the pace your governance allows. The platform's workflow, records and audit functions work the same either way.

Model versions are pinned in production; upgrades are tested for data handling and output quality before rollout, and every model must meet the same bar before it touches client data (Q8).

Yes. Access within your environment is role-based (RBAC). Your administrators assign each user a role, and roles determine what that user can see and do, down to the project, workspace, work process and record level. A field inspector, a QC reviewer and an executive each get exactly the access their job needs, and nothing more: the principle of least privilege.

Roles and permissions are set up with you during implementation, and your administrators manage users and roles afterwards without needing us.

MFA: yes, today.Authentication runs on AWS's managed identity service with individual named accounts; multi-factor authentication is supported and can be enforced for all of your users at your discretion.

SSO: available on request, as a paid add-on. SSO is not part of the standard subscription. Where an enterprise deployment requires integration with your identity provider (e.g., Microsoft Entra ID via SAML/OIDC), it is scoped and priced separately as part of the implementation plan.

Only the engineers who operate the platform, and only for operational need. Administrative access to production client data is limited to named individuals on a need-to-know basis, used solely for legitimate purposes (support, incident response, agreed implementation work). Privileged operations that bypass normal tenancy controls are themselves written to a separate audit log: every such access is recorded with who, when and why, and we can walk your team through that log in a security review. All personnel with production access complete security and privacy awareness training at onboarding and annually, and are bound by confidentiality obligations.

Backups: continuous and encrypted. Automated backups run continuously on AWS-managed infrastructure, encrypted like all data at rest, with point-in-time recovery for the database. Documents and backups are held in Amazon S3 storage, which is designed for 99.999999999% (eleven nines) object durability, with data stored redundantly across multiple availability zones.

Availability: financially backed at the infrastructure layer. The AWS services beneath the platform (compute, database, storage) each carry a financially backed AWS service level agreement.

We maintain an incident response process covering identification, containment, investigation, remediation and post-incident review. Platform and infrastructure activity is continuously logged and monitored through AWS-native security services, with automated alerting and threat detection to surface suspected incidents early.

Client data is handled by our cloud infrastructure (AWS) and the AI models used for your deployment. Every subprocessor is independently certified (SOC 2, ISO 27001 and related standards), and their audit reports are available from the compliance portals linked below.

Vulnerability scanning: yes.Automated dependency and vulnerability scanning is built into our secure development lifecycle (SDLC), security checks are enforced in code review, and the platform's highest-risk controls (client isolation, audit immutability, authentication) are covered by automated tests that run on every change.

Penetration testing: scoped per engagement. If your organization requires independent third-party penetration testing as a condition of deployment, we will scope it into the engagement, and results are shared with your team under NDA.

Yes. Many of our clients are adopting AI-enabled tools for the first time, often without an internal AI governance framework in place. We can share a starter framework for an enterprise AI usage policy, grounded in the NIST AI Risk Management Framework and OWASP guidance for AI applications, along with the evaluation questions we see IT teams ask of AI vendors. It is yours to adapt as you see fit. We are also glad to join a working session with your IT, cybersecurity or governance team.