Trust & Security

ARCHITECTURE

The architecture is the security model

Prism is not a cloud service with an on-prem checkbox - it only exists on your hardware. One machine in your office runs it; your team uses browsers on your network. There is no Reportil-side copy of your projects, parts, files or messages between teammates.

Your machine Runs the app. Holds the database, the uploads and the automatic daily backups.

Your network Your team reaches Prism in a browser over the LAN. Nothing routes through us.

Reportil No copy of your projects, parts, files or messages between teammates.

OUTBOUND TRAFFIC

Exactly what leaves your network

Traffic	What it contains	When
License heartbeat	Five values: the license ID, a locally generated instance ID, the app version, a build-integrity hash, and how this install takes updates (automatic, notify-only or manual). Two more appear only as exceptions - a one-off report that an update failed to install (the version and the reason), and any tamper signal the licence check has raised. No email addresses, no user names, and never project data, tasks, parts or files.	Periodically, to validate your license
AI requestsOPTIONAL	Text a user submits to an AI feature - plus, if the Knowledge Base is in use, a background summary of completed work. Sent to the provider you configured, or kept inside your own AWS account with Bedrock. Full breakdown on the network reference.	On user action, and on a 6-hour background timer; nothing at all until a key is configured
Contact-us messagesOPTIONAL	The message a user chooses to send to Reportil support, with their name, email and organization.	Only when a user presses Send
Update download	Nothing outbound - the app fetches the new version package. Before anything is installed, the archive must match an Ed25519-signed (version, SHA-256) statement from the license server; an unsigned or mismatched archive is refused before it is even opened. Whether this request happens at all is your choice - see below. Managed installs can disable updating entirely and run the program folder read-only (see the deployment guide).	On the setting you pick: by itself at start-up, on an admin's click, or never

That is the complete list of what Prism sends to Reportil. Optional integrations you switch on - an AI provider, shipment tracking, your own mail server - talk to their own services instead; every one of those destinations is itemised on the network page.

How this install takes updates is a setting you own

Three choices - plus a fourth that removes the capability from the machine altogether. The choice is enforced where it matters: the endpoints that would fetch a build check it, not only the buttons that call them.

Install automatically

The default. A new build is applied at start-up, before anyone is connected, and the previous build is kept beside it for rollback. Your data folder is never part of the swap.

Notify and wait

Prism never installs on its own. You are told a version exists and an admin decides when to click. Nothing is downloaded until then.

Never download

Nothing is fetched on a click or at start-up - both update endpoints refuse and the start-up updater stands down. You are still told a version exists; an admin takes the archive from phrizm.com/downloads and checks it against the SHA-256 published there. The refusal is in the server, not in the interface - a mode only the buttons honoured would be a suggestion.

Or remove the capability

A hardened install sets PRISM_AUTO_UPDATE=0 and runs the program folder read-only. That is checked ahead of the in-app setting, so no dropdown can talk the machine back into updating itself. Details in the deployment guide.

OWNERSHIP

Your data stays yours - enforced by design

The export is never locked

Even with an expired license, the full data export works. This is a hard guarantee in the product, not a policy.

Everything is a file you own

The database, uploads and automatic daily backups live in one folder on your machine.

A plain-markdown copy, on your disk

Optional one-way sync to an Obsidian vault gives you a plain-markdown copy of everything.

Access control

Seats

Seats are named emails - only assigned people can register or sign in; freeing a seat ends access on the next license check-in.

Roles - what kind of act

A ladder ships ready to use - read-only viewer, member, team leader, director, workspace administrator - and a workspace can fork its own roles from those, with a single capability switched on or off for one person on top. A role answers what kind of act you may perform. Sessions are signed with a key unique to your installation.

Tenancy - which records

A role does not say which rows. An endpoint handed a record id walks that record up to the workspace that owns it and refuses anyone who is not on it - so a valid session plus a guessed id still gets nothing. A regression suite exists for exactly this: an outsider must be refused at every surface while the owner still gets through.

Reporting line - which people

Reading what a named person has been working on is a third question, and rank cannot answer it: two team leads in one workspace hold identical keys. It is answered by the reporting line - yourself, anyone below you in it, or an administrator. Sharing a workspace is not enough, and neither is outranking somebody. An org chart nobody has filled in hides material rather than exposing it.

Offboarding

Offboarding is built in - transfer someone's work with a preview, deactivate with a 30-day restorable window.

Transport & integrity

LAN-first

Reachable as prism.local. Optional HTTPS with your own certificate and internal DNS name.

Signed licensing

Licenses and leases are Ed25519-signed; tampering invalidates them.

Verifiable builds

Every release publishes its code hash - compare with Prism.exe --attest.

AI & YOUR DATA

The part your IT team will ask about

AI in Prism is optional and off by default: with no provider configured, nothing is sent anywhere. Once you configure one, three kinds of request reach it - the text a user submits to an AI feature; if the Knowledge Base is in use, a background job that summarises completed work every six hours without anyone pressing a button; and, if someone asks the in-app assistant about a colleague they have tagged, that colleague's task rows. We would rather you hear all three from us than find them in a packet capture. With the providers Prism supports this traffic is not used to train models - API traffic is excluded from training under their commercial terms, with zero-data-retention available where the provider offers it - and with Bedrock it never leaves your own cloud account.

Strictest posture

AWS Bedrock - run the same models inside your AWS account and region. Prompts never leave your cloud boundary and are not shared with the model provider.

Bring your own keys

Anthropic, OpenAI or Google under your own agreements.

Or disable AI entirely

Without a provider, every AI feature refuses: the request returns an error and nothing leaves the machine. The buttons remain on screen - they tell you AI is not configured rather than pretending the capability was never there.

Asking about a person

The assistant can retrieve a tagged colleague's assigned tasks so a manager can draft goals from the record instead of from memory. Access is gated in code on the reporting line described above. The rest is prompt discipline rather than a filter - it is instructed to cite the task id behind every claim and never to score, rate or rank a person - and we would rather say which is which. Full detail, including where the safeguard stops, is in the privacy notice.

COMPLIANCE

Prism runs on your hardware and Reportil stores none of your data, so the compliance assurance lives with the AI provider you choose. Programs those providers maintain and independently certify:

SOC 2 Type II ISO 27001 ISO 42001 (AI management) GDPR · DPA available Zero-Data-Retention options HIPAA BAA available*

Held and certified by the AI providers, not by Reportil; current status is published in each provider's trust center. *Healthcare BAAs are offered by providers for qualifying use cases - we will help you put the right agreement in place.

Questions?

Send your questionnaire

Send your security questionnaire to reportil@reportil.com - with an architecture this small, the answers are short.