Security Overview
This page is for the person reviewing Proxara for a firm’s IT, security or privacy function. It describes what runs where, what is stored, who can reach it, and the limits we know about, first for the connector and then for Windows Redact. Where something is not yet settled, it says so.
The connector
- Sign-in. Each person signs in with their own Microsoft account. The firm’s Microsoft administrator approves Proxara once for the firm: the Proxara Sign-in app (name, email and sign-in only) and the firm’s own Proxara app. Proxara’s sign-in service at auth.proxara.ai issues the AI assistant a short-lived token for that person and that firm only, and the firm’s application checks it again on every request.
- The firm’s application and database. Each firm has its own application on Azure Container Apps in East US and its own Azure Database for PostgreSQL in Central US, with its own keys. A small registry that tells the sign-in service which firm a Microsoft tenant belongs to holds no client data.
- Reading the firm’s systems. The firm’s app reads Outlook, SharePoint, OneDrive and Teams through Microsoft Graph with each person’s own access, so a person sees only what they can already open. Background reading is limited to what the firm’s administrators choose: read access to the SharePoint sites they name (Sites.Selected), and mail only for the mailboxes in a group their Exchange administrator scopes. Karbon and CCH Axcess are read with the keys the firm’s administrators enter in the console.
- The model. The same open-weight model described below reads each document in Proxara’s Azure environment, so the firm’s documents are not sent to an AI provider to be read.
- What the AI assistant receives. Answers to the assistant’s requests, with recognized client names and identifiers (SSNs, EINs, account numbers, addresses, emails and phone numbers) replaced by codes such as P-7KQ2M. Amounts, dates and other context stay. The person sees the real values in the Proxara window inside the assistant. What a person types or attaches in the assistant itself goes to the assistant’s provider directly.
- Actions. The assistant can propose a client email, a Karbon update or filing a document. Each one is shown to the person with the real values and runs only after they approve it, from their own access.
What the firm’s database holds for the connector:
| Record | Contents | Protection |
|---|---|---|
| Client record | Names and identifiers and the code for each, which documents mention them, document types and dates, facts with a pointer to their evidence | Values, titles, paths and facts encrypted with AES-GCM; lookups by HMAC blind index |
| Model results | What the model found in a document, so it is not read twice | Encrypted; expires |
| Actions | Each proposed step with its real values, who approved it, the receipt | Steps encrypted |
| People | Microsoft account identifier, name, email, role, access mirrored from the firm’s systems, and each person’s Microsoft sign-in token | Tokens encrypted; revoked when a person is disabled, unlinks or leaves |
| Keys for Karbon and CCH | The values the administrator entered | Encrypted |
| Audit | Who asked, which tool, about which record, when and the outcome; who approved what | No document text |
Document contents are read from the firm’s systems when needed and are not kept.
Support access
Proxara staff reach a firm’s admin console only as read-only support, signed in from Proxara’s own Microsoft tenant, and only inside a session a firm administrator opens for them in Settings. Each page they view is recorded in the firm’s audit log.
Windows Redact
- Windows client. A signed, per-user application adds one Redact item to the File Explorer right-click menu. It reads the selected file and sends it to the firm’s redaction service address, which is fixed in the installer at build time. The client refuses any address that is not HTTPS.
- Redaction service. Proxara’s service runs on Azure Container Apps in the East US region. It reads the file, asks the model to mark sensitive values, replaces them with tags, writes the copy in the same format where the format allows, and checks the result before returning it.
- Model. The model is an open-weight model, currently from Google’s Gemma family, that Proxara runs on its own Azure GPU in East US. Google and other AI providers do not receive the files. Proxara does not use a firm’s files to train models for anyone other than that firm.
- Database. Azure Database for PostgreSQL in the Central US region holds the records listed below.
The client talks only to the firm’s redaction service. It does not contact an AI assistant, and Proxara does not send copies to one.
Data lifecycle
The original file and the returned copy are held in the service’s memory for the job only. They are not written to disk or to the database, and they are discarded no later than 15 minutes after the job’s last activity.
What is stored:
| Record | Contents | Protection |
|---|---|---|
| Identity records | Each protected value or name and the tag that stands for it | AES-GCM encryption; lookups use HMAC blind indexes, so the plain value is not needed to find a tag |
| Restoration evidence | The original text or image regions that the tags replaced in a returned copy, bound to that copy’s digest | Encrypted |
| Job records | Job reference, mode, the tags used, and the SHA-256 digest of the original file | Contains no document text |
| Usage records | Time, the Windows user name reported by the client, client version, file type, size, duration, outcome, and counts of protected values by kind | Contains no document text, file names or values |
| Firm redaction policy | The guidance text an administrator saved, up to 8,000 bytes | Encrypted |
| Slack installation | The credentials for the firm’s own Slack workspace, if the firm installs the app | Encrypted |
Identity records persist during the subscription so that a tag in a later file, or in a document Claude wrote, can still be restored. Service logs record job references, modes, counts and outcomes, never document values. Database backups are Azure’s automated backups, kept for 7 days and not geo-redundant. Deletion at the end of a subscription is covered in the Data Processing Addendum and the Order Form.
Encryption keys are derived from root secrets configured for the firm’s deployment. Traffic between the client and the service uses HTTPS.
Access control
The connector and the admin console use each person’s Microsoft sign-in, and the console admits the firm’s administrators only. Windows Redact has no per-employee sign-in today: each firm’s installer carries that firm’s service credential, so anyone who runs the firm’s installer can redact and restore files for that firm. Distribute the installer to staff only, and tell Proxara if it reaches anyone else. Records are kept per firm deployment and encrypted under that deployment’s keys.
Administrative access
Proxara personnel who administer the Azure environment have technical access to it, including the database and the keys the service uses. That access is used only to operate, support and secure the service. The service does not offer customer-managed keys today.
The fail-closed gate
The service returns a copy only when it has redacted the file and checked the result, or when a complete read found nothing to protect, in which case the copy is identical to the original and says so. Any other outcome is a refusal: no copy, the original unchanged, and nothing sent anywhere.
Restoration
Restoring works on files that contain Proxara tags. An unchanged Proxara copy is restored from its own encrypted evidence. An edited file, or a new document written by an AI assistant, may receive the saved name for a tag rather than the original wording. A tag the firm’s records do not recognize stays as a tag, and the window reports how many were left.
Windows package
The setup program is signed. The publisher shown by Windows is Jex Pearce, Proxara’s founder. Installation is per user under the user’s own profile and needs no administrator rights; an elevated installation is refused. Windows 11 on x64 PCs has been tested.
Slack
Slack is optional. If a firm installs the Proxara app into its own workspace, leaders it chooses see operational counts, source status and the reported Windows user labels. Slack never receives document contents, file names, protected values or tags. Policy cannot be changed from Slack.
Known limits
- Detection is not perfect. On a development set of test documents, the current model removed 304 of 310 marked sensitive values. Testing has also found useful text removed. Employees review each copy before sharing it.
- Macro content in Office files is carried unchanged and not inspected. Some unreadable embedded pictures are carried unchanged.
- Some PDFs are returned as flattened page images. Interactive fields, links, bookmarks and digital signatures do not survive.
- There is no fixed processing time. Ordinary files have taken seconds to about half a minute in testing; long returns and batches take minutes.
- The model runs on weekdays from 6:30 a.m. to 7:00 p.m. Mountain time unless the Order Form sets other hours. Outside them, files sent to Redact are refused with the hours, and new documents wait to be read; restoring files and approved actions keep working.
What we do not claim
Proxara does not currently hold SOC 2 or ISO 27001 certification, does not offer a HIPAA Business Associate Agreement, does not offer customer-managed keys and has not published a penetration test report. A firm that needs any of these should raise it before signing.
Security contact: security@proxara.ai. Please describe an issue without attaching client documents.