Security
Your clients' data, protected
Your clients trust you with their financial information. Here is how ProCharted protects it: from the Microsoft cloud it runs on, to who can sign in and see what.
Built on Microsoft Azure
The same cloud trusted by banks and governments
ProCharted runs on Microsoft Azure. Microsoft secures the data centers, hardware and network underneath: guarded buildings, redundant power and cooling, and protection against network attacks. Azure's data centers are independently audited against standards such as ISO/IEC 27001 and SOC 1 and SOC 2. These are Microsoft's certifications for its cloud; see the Microsoft Trust Center.
Microsoft-run data centersMicrosoft sign-in platformEncrypted SQL databaseEncrypted file storageAutomatic backups
Encryption
- Everything between your browser and ProCharted travels over an encrypted connection (HTTPS), for the app, the client portal and our servers.
- Documents are stored in Microsoft Azure Storage, which encrypts files at rest.
- Your firm's data is kept in Microsoft's managed SQL database service, which is also encrypted at rest.
Secure sign-in
- Your team signs in through Microsoft's identity platform, so ProCharted never sees or stores your password.
- Two-step sign-in with an authenticator app or an emailed code, plus recovery codes. Admins can require it for the whole firm.
- Admins can reset a person's two-step setup and remove people who leave.
The right access for each person
- Access levels and individual permissions decide who sees billing, reports, settings and the whole firm's work.
- People can be limited to the clients assigned to them.
- Every request is checked against your firm, so your data is only shown to your firm and to the clients you share with.
A record of every change
- The Activity log shows who created, changed, archived or deleted work, files, notes and clients, and when.
- Admins decide who can see the firm-wide log.
- Deleted documents go to a recycle bin for 90 days before they are erased.
A safer way to exchange documents
- Clients use the client portal instead of email attachments. They sign in with a password or a one-time code sent to their email, which expires after 10 minutes and allows only a few tries.
- Clients only see the files and invoices you share with them, and download links expire after 15 minutes.
- Uploads are limited to documents and photos.
E-signatures you can rely on
- Each client signer opens a personal link and confirms a code sent to their email before signing.
- Every step is recorded, and the signed PDF comes with a signing certificate.
- The signed copy is saved to the client's files automatically.
AI with guardrails
- AI only reads and drafts. It never sends an email or changes your work on its own.
- Your data is never used to train AI models.
- Only text is sent to the AI, never your files, and admins can turn AI off for the whole firm.
Trusted partners for payments and email
- Subscription payments are handled by Stripe. ProCharted never stores your card number.
- Your Outlook mailbox is connected through Microsoft's own sign-in, so ProCharted never sees your email password. You can disconnect it at any time.
- The full list of the services we use is in our Privacy policy.
Backups and monitoring
- Your database is backed up automatically by Microsoft Azure.
- Before every update we create a restore point and keep the previous version ready to switch back to.
- Our systems are monitored for errors, and our website forms are protected against robots.
Your data stays yours
- We use your data only to run ProCharted for you.
- After a subscription ends, your firm's data is deleted within 30 days, unless the law requires us to keep it longer.
- Read the details in our Privacy policy and User agreement.
Questions about security?
If you have a security question, or think you've found a security problem, email support@procharted.com. We take every report seriously.
Last updated: October 26, 2026.