Trust center

Give reviewers evidence.
Not security adjectives.

Use one place to review Pokor’s controls, legal terms, data processors, and current service status.

Download the DPA Review security controls

Review documents

Start with the document your reviewer needs

These pages answer different questions, so procurement, legal, and engineering reviewers do not have to search through one long marketing page.

Security controls

Account access, encryption, connected tools, AI boundaries, and retention.

Review security controls

Privacy policy

Collected data, legal purposes, service providers, retention, and user rights.

Read the privacy policy

Data Processing Addendum

Processor duties, subprocessors, transfers, incidents, and audit support.

Download the DPA

Service status

Current availability and active or resolved incidents.

Open live status

Terms of service

The account, subscription, content, and service conditions that apply.

Read the terms

Security contact

Report a suspected vulnerability or ask a security question.

Email [email protected]

Current posture

What is in place today

Concrete controls, documents, and commitments a reviewer can verify.

Available today

EU-hosted application infrastructure

Production application infrastructure is hosted in the European Union. International service-provider transfers use the safeguards described in the DPA.

Available today

DPA and incident commitments

Customers can sign the published DPA. It includes a 72-hour customer notification commitment after Pokor becomes aware of a personal-data breach.

Published today

Provider and data-path disclosure

Core, consent-based, and feature-specific service providers are identified below and described in the privacy policy.

Service providers

Who may process data, and why

Some providers support the core service; others are involved only when a customer enables a feature, accepts analytics, or connects a provider. The privacy policy explains the data involved in each path.

Provider	Purpose	When involved	Location / safeguard
Hetzner	Application hosting and database infrastructure	Core service	European Union
Cloudflare	Edge protection, AI Gateway routing, and R2 object storage	Core edge; AI and uploads when used	Global; SCCs or applicable safeguards
Stripe	Subscription and one-time AI-credit payments	When a customer purchases	United States; SCCs
Brevo	Transactional email, product updates, and newsletters	Service email; marketing only after opt-in	European Union
PostHog	Product analytics	Only after analytics consent	European Union
Sentry	Error tracking and diagnosis	When an application error is recorded	European Union
Laravel Nightwatch	Application health and performance monitoring	Core service monitoring	United States; SCCs

OAuth providers, connected integrations, and browser push services may also process data as independent providers selected by the user or their organization. See the privacy policy for those feature-specific details.

Need a counter-signed DPA or security questionnaire?

Tell us what the reviewer needs and include your company name. Paid-plan questionnaire requests are covered by the response terms in the DPA.