Skip to content
SOV Checkfor Procore
Log inGet pricing

Security

How SOV Check handles your data.

SOV Check reads the invoice attachments your subs put in Procore, compares them with what was entered, and keeps the facts and results, not the files. Here is what it touches, where it goes and how long it stays.

What it does with your data

  1. Procore notifies SOV Check when a commitment invoice is created or updated.
  2. SOV Check streams that invoice’s attachment from Procore. The file is never written to storage.
  3. An AI model reads the document to extract the invoice facts.
  4. Fixed rules compare those facts with the Procore record and show the result, or post it to your workflow step.

SOV Check does not keep copies of your invoice files. It stores the extracted facts, the check results and an audit history of each decision.

AI data handling

  • The model comes from OpenAI or Anthropic (Claude), chosen by us for accuracy, and is reached only through Vercel AI Gateway. SOV Check holds no direct account or key with either provider.
  • Every request requires zero data retention and forbids prompt training. Both are set in code on each request, and the gateway routes it only to providers with zero-data-retention agreements in place.
  • Your invoices are never used to train or fine-tune a model.
  • Only the invoice attachment and our extraction instructions are sent. Procore credentials and other project data never are.
  • AI only reads the document. Deterministic rules, not the model, decide whether an invoice matches.

Access to your Procore

  • SOV Check connects through Procore’s standard OAuth sign-in. We never ask for your users’ Procore passwords, and SOV Check stores none.
  • Each person sees only what their own Procore permissions allow, and accountants always act with their own login.
  • As a workflow step, a dedicated SOV Check user that you invite into your Procore company runs the automation, so Procore shows when the app, not a person, responded. It needs company admin rights to register the invoice webhooks and read the workflow configuration.
  • You can revoke all access at any time by deactivating that user or uninstalling the app.

Security controls

  • All traffic is encrypted in transit (HTTPS/TLS).
  • Procore connection tokens are encrypted before they are stored.
  • Every call from Procore to SOV Check is authenticated with a secret.
  • Sign-in is limited to approved company email domains.
  • Admin actions, such as changing the mode or registering webhooks, are limited to named users at your company.
  • SOV Check starts in Test run: it records what it would decide and changes nothing in Procore until you switch it on.

Sub-processors

Sub-processorPurposeData it handles
VercelApplication hosting and AI gatewayRequests in transit; invoice attachments passed to the AI model
UpstashDatabase (Redis)Extracted invoice facts, check results, audit history, encrypted connection tokens
OpenAI or Anthropic, reached only through Vercel AI GatewayReading invoice attachmentsOne invoice attachment per request, with zero data retention

We notify customers in advance before adding or changing a sub-processor.

Retention and deletion

  • Invoice files: not stored.
  • Extracted facts, results and audit history: kept for the life of the subscription. Earlier invoices are needed to catch duplicates and split invoices across projects and over time, and the history shows who approved, corrected or returned each invoice.
  • On termination: all of your data is deleted within 30 days, or exported to you first on request.

Compliance

SOV Check does not hold its own SOC 2 report. Vercel, Upstash, OpenAI and Anthropic each hold SOC 2 Type II reports, available from their trust portals.

Questions? Write to hello@sovcheck.com or request a walkthrough.