How ProBidCore protects your data
Your estimates, Procore connection, and account data deserve honest, verifiable security practices — not marketing claims. Here is exactly what ProBidCore does to protect them.
HTTPS everywhere
All traffic between your browser and ProBidCore is encrypted in transit using TLS. There is no unencrypted HTTP endpoint in production.
OAuth 2.0 — no Procore passwords stored
The Procore connection uses OAuth 2.0 Authorization Code flow with PKCE. ProBidCore never sees or stores your Procore password. You authorize via Procore's own login page, and ProBidCore receives a short-lived access token that it can use only within the scope you grant.
Tokens encrypted at rest
OAuth access and refresh tokens are encrypted with AES-256-GCM before being written to the database. The encryption key is stored separately from the data and is never logged or exposed in API responses.
Tenant-isolated data
Every database query is scoped by your user ID. One account cannot read or modify the projects, line items, or estimates belonging to another account. This isolation is enforced server-side, not just in the UI.
Standard SaaS security practices
ProBidCore runs on managed cloud infrastructure with automated backups, dependency auditing, and secret rotation practices. Rate limiting is applied to public endpoints to defend against abuse.
Procore authorization boundary
ProBidCore syncs estimates only to the Procore projects you explicitly link. It cannot browse or modify Procore data outside those linked projects. You can revoke the Procore connection at any time from your settings page.
What ProBidCore does NOT claim
ProBidCore is not SOC 2 certified, HIPAA compliant, or ISO 27001 certified. We follow standard SaaS security practices appropriate for a construction estimating tool. If your organization has specific compliance requirements, contact support@probidcore.com before signing up.
Frequently asked questions
Is ProBidCore SOC 2 certified?
Not yet. ProBidCore is an early-stage product applying standard SaaS security practices. We follow the controls described on this page and will pursue formal compliance audits as the product matures.
Where is my data stored?
Project data, line items, and account information are stored in a managed PostgreSQL database hosted in the United States. OAuth tokens are stored encrypted in the same database.
Can I delete my data?
Yes. You can delete individual projects from the app. To delete your account and all associated data, contact support@probidcore.com and we will process the request within 30 days.
How do I revoke ProBidCore's Procore access?
Open ProBidCore settings → Integrations → Disconnect Procore. This immediately deletes the stored OAuth tokens. You can also revoke from the Procore side: Procore → Your Profile → Authorized Apps.
Security question or concern?
Email support@probidcore.com and we will respond within one business day.