Trust Centre FAQ
Version: 1.0 · Owner: Pocket PMO Ltd · Approval status: Approved · Review date: quarterly
Is Pocket PMO SOC 2 or ISO 27001 certified?
Not today. Formal certification is on our post-launch roadmap. We publish this openly because we would rather earn trust with honest architecture and controls than with a badge we do not have.
Where is my data stored?
Customer data is stored in a managed Postgres database (Supabase, via Lovable Cloud). The primary region is confirmed with our hosting provider and available on request. AI prompts pass through the Lovable AI Gateway to a model provider; the AI region is also available on request.
Do you train AI models on my data?
No. Providers accessed through the Lovable AI Gateway are contractually required not to train on customer content and to keep prompts transient. Attestations are held on file and available on request.
Do you have a DPA?
Yes. A draft DPA is available on this Trust Centre, and an executable version can be requested at admin@pocketpmo.co.uk.
What is your uptime SLA?
Pocket PMO is delivered on best-efforts availability on managed infrastructure today, with no contractual uptime SLA in our standard terms. Enterprise contracts can include a bespoke availability commitment on request. We publish incidents on the status route when they happen.
How do you handle a breach?
We notify affected customers of a confirmed personal-data breach within 72 hours of confirmation, and notify the ICO within 72 hours where the breach is likely to result in a risk to individuals (UK GDPR Art. 33). See the Incident Response Policy.
How does MFA work?
TOTP MFA is available for every account via the MFAGate flow. Enforcement policy per role is confirmed with our security lead and can be described on request.
Can I export my data?
Yes. Export is available in-product and via the REST API. JSON and CSV are supported for the most common entities.
Can I evaluate Pocket PMO before providing a payment card?
Yes. A new account can create one real project and one snapshot report without a card. Other workspace areas remain unavailable until a plan is chosen. If the project is kept, it can be assigned to the first client created during setup and its linked roadmap and approved pipeline records are created from the information already supplied.
What happens on account closure?
Personal data is deleted within a maximum of 30 days of account closure, subject to legal record-keeping (payments) and the managed platform's backup retention window.
What are your support hours?
Monday to Friday, 09:00–17:00 UK time, excluding UK public holidays. We aim to acknowledge every support request within one business day. Security incidents are handled outside these hours in line with the Incident Response Policy.
Do you use cookies?
Only first-party, functional cookies. See the Cookies notice at /cookies.
Are there restrictions on how I may use the platform?
Yes. Normal customer use of Pocket PMO for your own project delivery is unrestricted. Our Terms of Service prohibit competitive use: using the platform (or information about it) to design, build, train, benchmark or improve a competing product, copying our screens, workflows, AI prompts or report templates, reverse engineering, scraping or bulk recording of the product, and sharing or rotating a single user licence between individuals. Seat limits are enforced technically, and accounts breaching these clauses may be suspended immediately. See section 4 of the Terms of Service at /terms.
Who should I contact for security or privacy questions?
- Security:
admin@pocketpmo.co.uk - Privacy:
admin@pocketpmo.co.uk - Responsible disclosure:
admin@pocketpmo.co.uk
Owner confirmation required
- H-01/H-02 regions; D-05 model no-training statement; S-08 MFA enforcement policy.
- Insurance cover (L-06) and formal incident-response on-call rota (S-07) remain open and will be confirmed prior to enterprise contracting.
Document history
| Version | Date | Change | Author |
|---|---|---|---|
| 1.0 | 13 Jul 26 | Initial FAQ. | Pocket PMO |
| 1.1 | 17 Aug 26 | Added acceptable-use / competitive-use restrictions question. | Pocket PMO |
| 1.2 | 10 Sep 26 | Added the one-project, no-card evaluation path. | Pocket PMO |
Can shared reports be restricted to named recipients?
Yes. Each published report carries an access setting. The default for new reports is invited people only: the publisher adds readers by name and email, and a reader must enter their address and a single-use 6-digit code emailed to them before the report opens. Codes expire after 15 minutes, wrong codes are attempt-limited and rate limited, and a verified browser stays trusted for 30 days. Removing an invited reader ends their access immediately, including browsers already verified. Publishers may instead choose "anyone with the link" for non-sensitive reports.