Data privacy and security built into the workspace
Proofsource gives you control of your data and clear limits on what the product can touch. Export your whole workspace as one ZIP, delete your account, and set retention in Settings, Data and privacy. Every request is scoped to your workspace, connected keys and tokens are encrypted at rest, and you can see the fixed addresses Proofsource uses to read your site. For security reviewers and data owners.
| Date | Event | By |
|---|---|---|
| Oct 29 | Workspace exported as ZIP | maya@driffle.ai |
| Oct 12 | Retention set to 24 months | maya@driffle.ai |
| Oct 3 | Data request closed after erasure | Proofsource |
Data privacy and security, in short
The facts, ready to quote.
- Export and deletion
- Whole workspace as one ZIP; account deletion and logged data subject requests
- Retention
- Set in Settings, Data and privacy
- Isolation
- Every request and job is scoped to one workspace
- Secrets
- Connected keys and OAuth tokens encrypted at rest with rotating keys
- Site reads
- Fixed crawler addresses, an allow header and an access log
- Sign-in
- No passwords; email codes, Google or SSO
Data privacy in an AI visibility platform, explained
An AI visibility platform holds more than scores. It stores your tracked questions, competitor lists, answers about your brand, analytics connections and sometimes keys to your website or CMS. Data privacy here means three things: you can take your data out, you can have it removed, and other customers can never see it.
Proofsource covers the first two in Settings, Data and privacy. A data export streams your workspace as one ZIP. Account deletion and data subject requests are logged and carried out by an erasure job. Retention controls decide how long data is kept.
Isolation is enforced underneath. Each request and each background job is pinned to one workspace at the database level, and the service refuses to start if it could bypass that rule. Keys and OAuth tokens you connect are encrypted at rest. Agents that call outside services may only reach hosts on your allow-list, and agent schedules run at most once an hour.
How it works
Export or delete your data, control retention, keep each workspace isolated, encrypt connected keys, and see exactly how Proofsource reads your site.
Open Data and privacy
Owners find retention, export and deletion in one Settings section.
Export everything
Start an export and download the workspace as one ZIP.
Delete when you leave
Delete the account. Requests are logged and an erasure job carries them out.
Check how we read your site
Site access lists our fixed crawler addresses, the allow header and an access log.
Limit outbound calls
Add hosts to the allow-list before an agent's Call API step may reach them.
See it in the product
Screens from the Proofsource app, drawn with sample data for an example brand.
| When | Page | Result |
|---|---|---|
| Today 08:02 | driffle.ai/pricing | 200 |
| Today 08:02 | driffle.ai/vs-otter | 200 |
| Yesterday 08:01 | driffle.ai/blog/ai-notes | 301 |
- hooks.driffle.ai
- api.hubspot.com
Every capability, live today
9 shipped capabilities behind data privacy and security, each in the product now.
Data subject requests
A log of data requests and an erasure job that carries them out.
Workspace isolation
Every request and job is scoped to its workspace and organization at the database level, with roles checked, so one customer's rows are never visible to another. The service refuses to start if it could bypass that isolation.
Encrypted keys and tokens
Keys and OAuth tokens you connect are encrypted at rest with rotating keys.
Request and link protections
Cross-site request protection, strict security headers and a content policy on every dashboard response, size limits, and site data cleared on sign-out. Scripts are stripped from document markup written by agents or read from the web, and share, invite and unsubscribe links use their own secret tokens, separate from sign-in.
Guarded agent calls
An allow-list of hosts your workspace permits, so agents may only send to those hosts. The agent builder's Call API step refuses private and internal addresses, and agent schedules may run at most once an hour.
Site access settings and log
Shows our fixed crawler addresses, your allow header and a record of each time Proofsource read your site.
Security and subprocessors
Read Proofsource's security practices and compliance statement, plus the list of vendors that process customer data.
Data export, erasure and retention
Request a full archive of your workspace as one ZIP with a download link, delete your account so stored files are deleted and subscriptions canceled, and rely on a written retention schedule that is enforced daily. Controls live in Settings, Data and privacy.
Daily automated backups
Your data is backed up automatically every day, with a stated retention period.
Who it is for
Answer the questionnaire
Isolation, encryption at rest, passwordless sign-in and SSO cover the usual review lines.
Handle data requests
Exports and erasure requests are logged and carried out by the product.
Allow our reads safely
Fixed crawler addresses and an allow header let you permit Proofsource without opening your site to everyone.
Contain agent calls
Agents may only call hosts you list, and never internal addresses.
Why it matters
Your data, portable
One ZIP export whenever you need it.
Isolated by design
Workspace scoping is enforced underneath every request.
Secrets protected
Connected keys and tokens are encrypted at rest.
Transparent site reads
See every read of your site in the access log.
Google AI OverviewsGoogle AI Mode
Data privacy and security: Proofsource and other tools
Security and data controls are described differently by each company. From their own public pages:
| Capability | Proofsource | AthenaHQ | Profound | Scrunch | Peec AI | Otterly.AI |
|---|---|---|---|---|---|---|
| Data export | YesWhole workspace as one ZIP | RelatedCSV data export on StarterSource | RelatedCSV and JSON exports on EnterpriseSource | RelatedEnterprise Data API for internal systemsSource | RelatedCSV export on all plansSource | RelatedCSV or JSON of raw answersSource |
| GDPR data requests | YesLogged requests with an erasure job | YesTrust center states GDPR complianceSource | Not listed | Not listed | Not listed | Not listed |
| Shared secrets kept out of sight | YesConnected keys and tokens encrypted at rest | Not listed | YesSecret Manager stores API keys centrally so teammates use them unseenSource | Not listed | Not listed | Not listed |
| Allow-list for agent outbound calls | YesPer-workspace host allow-list | Not listed | Not listed | Not listed | Not listed | Not listed |
| Roles and access control | YesEvery request scoped to its workspace, with roles checked | YesUnlimited seats with roles on Starter and EnterpriseSource | YesRole-based access and SCIM provisioningSource | YesRBACSource | YesCompany-wide members view with role-based access and CSV exportSource | RelatedRead-only member roleSource |
| Security attestation and compliance statement | YesSecurity practices, compliance statement and the list of vendors that process customer data | YesTrust center states SOC 2 Type 2Source | YesSOC 2 Type II certifiedSource | YesCompliance certificationSource | Not listed | Not listed |
| Data kept apart per client or workspace | YesEach organization separated at the database level | Not listed | Not listed | Not listed | RelatedIsolated project per client; unlimited client workspacesSource | Not listed |
Where each of them shines
AthenaHQ runs a public trust center stating SOC 2 Type 2 and GDPR.
Profound is SOC 2 Type II certified and offers a Secret Manager for shared keys. Compare in full
Scrunch holds SOC 2 Type II and offers enterprise SSO and role-based access. Compare in full
Otterly.AI exports prompts, citations and raw AI answers as CSV or JSON, and has a read-only viewer role. Compare in full
Questions about data privacy and security
Can I export all my data from Proofsource?
Yes. Settings, Data and privacy starts an export that streams your workspace as one ZIP.
Can I delete my account and data?
Yes. When you ask to delete your account or data, the request is logged and every brand, answer and connection is erased.
Can other customers see my data?
No. Every request and background job is scoped to one workspace at the database level, and the service will not start if it could bypass that.
How are my connected keys stored?
Keys and OAuth tokens you connect, such as for analytics or your CMS, are encrypted at rest with rotating keys.
How does Proofsource read my website?
From a fixed list of crawler addresses with an allow header, and every read appears in the Site access log.
Can agents call any website?
No. An agent's Call API step may only reach hosts on your workspace allow-list, never private or internal addresses, and agent schedules run at most hourly.
Do you use passwords?
No. Sign-in is by email code, Google or your SSO provider.
Who can change privacy settings?
Workspace owners and admins, and sensitive changes ask for a fresh sign-in code.
Keep exploring
Try it on your own brand.
Proofsource is live: scan your brand and see data privacy and security at work with your own answers, competitors and sources.
Google AI OverviewsGoogle AI Mode