Trust
Security
Last updated 30 October 2026
PMO Gateway (pmogateway.com) · Contact info@pmogateway.com
PMO Gateway (pmogateway.com) generates and governs project documents. Here is exactly where that data lives and who can touch it.
Controls
Organization isolation
Every project and all project-linked data belong to one organization. Database row-level security checks organization and project membership on every read and write, so one company can never see another company's data.
Role-based permissions
Approvals, gate sign-offs and tailoring changes run through checked database functions. Organization admins cannot approve documents; only the committee chair decides.
Encryption
All traffic uses HTTPS (TLS). Data at rest is encrypted by the hosting provider's managed database and storage.
Backups
The hosting provider takes one automatic database backup per day, kept for about 14 days. Point-in-time recovery is not available.
Immutable audit trail
Every document change creates a permanent version. Submissions keep a frozen snapshot; reviews, decisions, waivers, withdrawals, tailoring requests and gate sign-offs are kept with who and when. Projects with governance history can be archived but not deleted.
AI usage logging
Each AI call is logged by organization, project, user, action, model and token count, with a monthly limit admins can see.
Data export
Organization admins can download all organization data as a ZIP at any time, on any plan, including read-only accounts. Each export is logged.
Private files
Organization logos are kept in private storage, not public links.
Subprocessors
| Service | Purpose | Data received | Location |
|---|---|---|---|
| Lovable Cloud (built on Supabase, hosted on AWS) | Database, sign-in and private file storage (logos) | All customer content: projects, documents, versions, approvals, notes, templates, members and the AI usage log | EU — Ireland (AWS eu-west-1) |
| Lovable hosting (Cloudflare edge network) | Runs the web application and server functions | Requests in transit; the app stores nothing outside the database | Global edge network |
| Lovable AI Gateway, routing to OpenAI models | AI drafting, interviews, consistency checks and document import | Text sent with each AI request (see AI data use) | Not confirmed; may be outside the EU |
| Resend (through the Lovable connector gateway) | Governance notification emails | Recipient email, project and document name, short event summary | Not confirmed (United States based provider) |
| Stripe | Subscription billing | Organization name, billing email and plan; card details go directly to Stripe | Not confirmed (United States based provider) |
- No third-party marketing or behavioural analytics scripts are loaded in the app.
- No third-party error-tracking service receives application data.
Certifications
PMO Gateway does not hold its own SOC 2 or ISO 27001 certification and has not commissioned a third-party penetration test. See the Trust center for how we support security reviews.
Questions? Request our security questionnaire answers.