Last updated: 1 June 2026
Security isn't a feature bolted on later — it's how ProposalBolt is built. Here's how we protect your business and your clients, described honestly.
Data is encrypted in transit with TLS, and encrypted at rest (AES-256) within our database and storage provider.
Every workspace's data is isolated at the database with row-level security and role-aware access policies — enforced in the database itself, not just in application code, so one workspace can never read or write another's.
Two-factor authentication (TOTP authenticator apps) for accounts, role-based access control within a workspace, and single sign-on (SAML SSO) for Enterprise.
Card and UPI payments are processed by Razorpay — we never store card numbers. Payment confirmations and webhooks are cryptographically signature-verified before anything is recorded.
Electronic signatures capture a tamper-evident certificate — IP address, timestamp, and a content hash — and only the verified signing flow can mark a document accepted. Privileged administrative actions are written to an append-only audit log.
A strict Content-Security-Policy, HTTP security headers (HSTS, nosniff, frame protection), server-side input sanitisation, and rate limiting on sensitive endpoints.
We build to widely-recognised security practices and support your GDPR / India DPDP obligations through our Data Processing Addendum and self-serve data export and account deletion. Our subprocessor list is published for due diligence. Formal third-party certifications (such as SOC 2) are on our roadmap — talk to us about your requirements.
We run on managed, highly-available infrastructure with automated backups and point-in-time recovery available through our database provider. Contractual uptime SLAs are available on Enterprise agreements.
Found something? Please email us — we welcome responsible disclosure and will work with you on a fix.