Skip to main content

Security and data protection

This page answers what teams usually ask before connecting their keys and mailbox to Pranory: where the data lives, how it is protected and who else processes it. The formal commitments are in the Privacy Policy and the Terms of Service.

Where your data lives

  • Hosting: the application, the database and the job queues run on an IONOS SE server in Spain, inside the European Union.
  • Encrypted connections: all traffic goes over HTTPS. Session cookies are only sent over HTTPS and the browser doesn't let any script read them.
  • Providers: who else processes data to run the service, what for and from where is in the subprocessors list.

Your Google Maps and AI keys

Pranory always runs on your own key for Google Maps and AI. That has a security upside: the key is yours, you see the usage in your own console and you can restrict or revoke it whenever you want, without depending on us.

  • Stored encrypted: keys are stored encrypted with AES-256. On screen you only see their last few characters.
  • Only for what you run: we use them only for the searches and enrichments you request from your workspace.
  • Restrict them at the source: we recommend restricting your Google Maps key to the APIs Pranory uses and to our server's IP. We explain it step by step in Protect your Google Maps key.

Your mailbox

Emails go out from your mailbox, under your name, through your email provider (SMTP), and replies are read from that same mailbox (IMAP). Pranory doesn't send your campaigns from its own servers.

  • The SMTP/IMAP password is stored encrypted and is never shown again.
  • You can disconnect the mailbox at any time. To cut off access completely, change the password or revoke the app password at your email provider.

Who can access what

  • Roles: each workspace has three roles: owner, admin and member. Only the owner and admins can change settings, connect keys and mailboxes or add people to the team.
  • Separate workspaces: each workspace's data is isolated from the others; nobody from another team can see it.
  • Passwords: stored as a hash (bcrypt), never in readable form.
  • Protected forms: public forms use bot protection (Cloudflare Turnstile) to stop automated submissions.

Backups and errors

  • Daily backups: we back up the database every day and keep a copy off the main server.
  • Error logging: we use Sentry to catch failures. It is configured not to send personal data such as your IP or email.

You process the businesses and contacts you work on in Pranory: you decide who to write to and you are the controller of that data. We act as processor, and the terms are in the Data processing annex of the terms.

The usual basis for processing a business's contact details is legitimate interest (art. 6.1.f GDPR). To send them commercial emails, Spanish law (LSSI) generally requires prior consent, also when you write to businesses. If you do write, do it one at a time, to contact addresses the business publishes itself, with a message related to its activity, identifying yourself and offering in every email an easy way to opt out.

Pranory helps you do it right:

  • Every email goes out under your name and from your mailbox, never from an anonymous address.
  • If someone replies asking to opt out, Pranory detects it and cancels their sequence.
  • Pranory doesn't add an automatic unsubscribe link: include a line in your templates so people can ask to opt out.

Complying with the law towards the people you write to is your responsibility. If in doubt, ask a professional.

Data processing agreement (DPA)

The data processing agreement (art. 28 GDPR) is part of the Terms of Service and is accepted when you create your account. If your company needs a signed copy, write to hello@pranory.app.

Your rights and your contacts' rights

  • If you use Pranory: you can request access, rectification, erasure, objection, restriction or portability of your data by writing to hello@pranory.app. We reply within one month at the latest.
  • If a Pranory customer wrote to you: contact whoever wrote to you first, as they are the controller of your data. If you write to us, we will pass your request on to them.
  • When you delete your account: if you are the only member of your workspace, it is deleted with all its data and the subscription is cancelled. Before that you can export your businesses and opportunities as CSV or XLSX.

Found a security issue? Write to hello@pranory.app and we'll get back to you as soon as possible.