Access and logging
How an officer signs in, how each of your systems is reached, who at Proxara can reach the data, and what is recorded and never logged.
Updated 2026-10-31
An officer sees only their own calls, signed in with a code sent to their work email. Borrowers see nothing of Proxara. No screen at Proxara shows a call, and Proxara’s operators can reach the stored data only to run and repair the service.
Signing in
- The app: a six-digit code sent to the officer’s work email, good for 10 minutes and one use. Five wrong tries delete it, and only an address on the invitation list gets one. A phone stays signed in for 90 days from its last use, and only a hash of its token is stored.
- A Social Security number or date of birth: Face ID in the app. From an email, the link opens nothing by itself: the officer asks for a code, it goes to their sign-in address, and the value shows for two minutes. A forwarded email opens nothing.
- Connecting from a computer: a link emailed to the officer, which works for a day. Only a hash of it is stored.
With your systems connected
- In Teams: the officer’s questions arrive in Proxara’s app in Teams, where they are already signed in. Proxara takes an answer only when Teams has signed it, and only from the officer the question is for, so a forwarded message answers nothing.
- Without Teams: a text links the officer to a page that asks only that question. The link alone shows whose page it is and nothing about a borrower. Everything waits for the officer’s sign-in with their company Microsoft account, under the company’s own MFA and conditional access. Someone else signed in sees nothing and can answer nothing, and a link stops working after a week.
- The setup page: opened from a link only the officer is sent. It stops working two weeks after it is made, and a new link replaces the old one.
- Every link: a token of 144 random bits, of which only a SHA-256 hash is stored. An address that opens twenty links to nothing within ten minutes is turned away from all of them for ten minutes.
Reaching your systems
The app reaches none of them. Once you connect them, each system is reached through one account or consent your administrators give, and you can withdraw any of them at any time.
- Encompass: a Proxara user the lender’s administrator creates. Its persona limits what it can write, and Proxara writes only the loan fields on its own list.
- Microsoft 365: mail, calendar and contacts through Exchange’s own scoped permissions for the officers’ group alone, and Proxara’s Teams app, installed by the Teams administrator for the officers.
- The CRM: Total Expert’s partner access, switched on by the lender.
- The borrower app: a key the lender’s administrator issues.
Proxara’s access
In Proxara’s AWS and Azure, Proxara’s operators can reach the stored data to run and repair the service. There is no screen for reading calls, and the running server takes no remote login. An administrator of Proxara’s AWS account could still reach the storage and the sealing key. In an install in the lender’s own Azure, Proxara holds no account or role in it.
Leaving
When an officer deletes their account in the app, everything Proxara holds for them goes at once, and their greeting and number go at Telnyx.
When a lender takes an officer off a connected install, the officer stops being worked at once: no call of theirs is heard, no message is drafted, and their question links open nothing. Thirty days later everything Proxara holds about their borrowers is deleted. Their name and email stay, to show when they were taken off. The lender’s own Encompass, CRM and Outlook keep the loans and contacts.
What is recorded
| Event | What the record holds |
|---|---|
| A Social Security number or date of birth opened | Which call, by id, never the value |
| A change on Monday | What changed, what was there before, and the call behind it |
| The officer’s yes, in a connected install | Who answered, when, and what they were shown |
| A write to Encompass, the CRM or Outlook | What was written, what was there before, and the facts behind it |
| A message sent in the officer’s name | Who it went to, when, and the yes that sent it |
| A person forgotten at their request | How many records went, never whose |
What a log never holds
A value from a call or a page: no names, Social Security numbers, figures, addresses or words that were said. Logs carry identifiers and counts (which call, which action, how long it took), are kept for 30 days, or 90 in a connected install, and request logs are off.