Security at Progressive Solutions

PSI holds business license, permit, animal license, alarm, parking and utility billing records for public agencies, and processes payments made by their residents. That data is not ours. We hold it on behalf of the agency, and this page describes how we protect it.

Program status

PSI is completing a SOC 2 Type II readiness program during 2026, using Vanta for continuous control monitoring. Our Trust Center publishes the live status of individual controls and is the authoritative source. If your procurement process needs a security questionnaire, a completed CAIQ, or evidence of a specific control, ask us and we will provide what is available at that point in the program.

Some of the practices described below are established and some are being formalized as part of that program. Where a control is still being rolled out we say so on this page rather than implying it is finished. The Trust Center is the place to check current status before you rely on any single item.

Where your data lives

Client environments run on Amazon Web Services and Microsoft Azure in United States regions. Each client agency has its own database. We do not operate a shared multi tenant database across agencies, so one agency’s records are not co-mingled with another’s. Our software is written and supported in the United States, and we do not offshore development or support.

Encryption

• In transit. Public traffic to our websites and hosted portals uses HTTPS with TLS. Administrative access to servers uses SSH with key based authentication or an encrypted management channel provided by the cloud platform.
• At rest. Server volumes and managed storage in AWS and Azure are encrypted at rest with platform managed keys.
• Payment data. Card details are entered directly with a PCI DSS validated processor. PSI does not store full card numbers, magnetic stripe data or card verification values.

Access control

• Administrative accounts are individually named. Shared logins are not used for administration.
• Access follows least privilege and is granted for a documented business reason.
• Server access uses per server SSH keys rather than shared passwords.
• Access is reviewed periodically and is removed when a person changes role or leaves.
• Remote administrative access to client environments is restricted by firewall rule to known addresses rather than being open to the internet.

Network and infrastructure

• Cloud firewalls restrict inbound access to the ports each service requires, with database and remote administration ports limited to approved source addresses.
• Firewall rules are reviewed at least annually and after any material change, and the review is recorded.
• Systems are patched on a regular cycle, with security updates prioritized.
• We monitor vendor and platform security advisories for the components we run.

Backup and recovery

Client databases are backed up on an automated schedule, with copies written to durable cloud storage that is separate from the server being backed up. Backup jobs are monitored. Restores are performed and verified when a recovery is requested or required, and we are adding scheduled restore testing on a documented interval as part of our 2026 readiness program. Retention is set to meet the recovery objectives in the agreement with each agency.

Application security

• Source code is held in private repositories with change history and review.
• We track security advisories for the frameworks and libraries our products depend on, and we are enabling automated dependency vulnerability scanning across our repositories as part of our 2026 readiness program.
• Changes are tested before release to production environments.
• Public facing applications are built to the Web Content Accessibility Guidelines version 2.1 Level AA, so that security controls do not come at the cost of access.

People

• Client data is treated as confidential. We use confidentiality terms covering client data in our personnel and contractor agreements, and we are completing signed coverage across everyone with access as part of our 2026 readiness program.
• Security responsibilities are set out in our information security policies, which personnel acknowledge.
• We are putting a formal security awareness training program in place during 2026, with completion tracked for every person who has access to client systems.
• Access is revoked as part of a documented offboarding checklist when someone leaves.

Vendors

We keep the vendor footprint deliberately small. Vendors that can touch client data, principally our cloud providers, our support ticketing system and our email provider, are reviewed for their own security posture before use and periodically afterward. Our published list of service providers appears in the Privacy Policy.

Incident response

PSI maintains a documented incident response process covering detection, containment, eradication, recovery and review. If we become aware of an incident affecting a client environment, we notify the affected agency without unreasonable delay, work the incident with them, and support any notice the agency is required to give under California Civil Code sections 1798.29 and 1798.82 or the equivalent law of its state. Each significant incident is followed by a written root cause analysis.

Your responsibilities as an agency

Security is shared. The controls above protect the platform. Within your own portal you control who has staff accounts, what role each account holds, and how quickly departing staff are removed. Tell us promptly when staff leave, keep your own workstations patched, and use the account review reports we provide.

Reporting a vulnerability

If you believe you have found a security issue in this website or in a product we host, tell us. Email support@progressivesolutions.com with "Security report" in the subject line. Include enough detail to reproduce the issue, and give us a way to reach you.

What we ask. Give us a reasonable period to fix the issue before disclosing it publicly. Do not access, modify or delete data that is not yours, do not degrade service for others, do not run automated scans that generate significant load, and do not use social engineering or physical attacks against our staff or our clients.

What we commit to. We will acknowledge your report within three business days, tell you whether we can reproduce it, keep you informed while we work on a fix, and credit you if you would like to be credited. We will not pursue legal action against anyone who reports in good faith and follows the guidance above. We do not currently operate a paid bug bounty.

Questions from procurement

For security questionnaires, insurance certificates, subprocessor lists or contract language on data protection, contact sales@progressivesolutions.com or call 714-671-1597. Current control status is published continuously in our Trust Center.