Trust is what we sell, so it's how we run. Here's how Provena Trust handles your data, proves its controls, and supports your procurement and vendor-risk process.
⚠ Internal note — confirm each status before publishing; do not list an attestation we don't actually hold.
We use a short, vetted list of infrastructure and tooling subprocessors — cloud hosting, monitoring, and transactional communications. The current list, with purpose and data scope for each, is maintained as a living document and provided in the security package. Customers are notified of material changes.
The whole product exists because assertions aren't evidence. We hold ourselves to the same bar: where we make a security claim, we can show the control behind it — and where something is still on the roadmap, we say so plainly rather than implying more than is true. That honesty is the point of a trust company.
SIG / CAIQ responses, the DPA, our subprocessor list, and the latest pen-test summary — sent to your security or procurement team under NDA.