Implemented safeguards, operational limits and how to report a security concern.
The product implements workspace-scoped database row-level security, role-based permissions, current membership checks and an append-only audit trail for security and administrative actions. Organization permissions and workspace evidence access have separate boundaries. Connector credentials are encrypted with AES-256-GCM; traffic uses TLS and infrastructure providers supply encryption at rest.
A workspace is pinned at creation to its assigned regional cell: Central US or North Europe (Ireland). Its delivery evidence, financial inputs, connector credentials, reports and PDF snapshots, export artifacts, database backups, blobs, queues and operational telemetry stay in that data plane. Staging uses one US environment.
Shared accounts, authentication sessions, memberships, workspace directory and billing metadata remain in the US control plane. Ireland uses short-lived regional grants and pseudonymous audit actors; current authorization, commercial policy, aggregate limits and technical recovery metadata cross the authenticated control-plane channel without copying delivery evidence. Global edge routing and providers for billing, mail, analytics or AI have separate locations, described in the subprocessor list. Manual Ask uses Microsoft Foundry: a US Data Zone deployment for US workspaces and an EU Data Zone deployment for EU workspaces. Inference may run elsewhere within the selected data zone. The regional application sends questions and selected evidence to its selected data zone and stores answers in the assigned workspace data plane. Bounded credit and operation metadata goes to the shared US control plane.
Plan data windows, scoped JSON/CSV exports, a 30-day deletion grace, automated workspace purge and a durable deletion ledger are implemented. Exports omit secrets and raw provider payloads. Raw connector responses expire automatically 90 days after fetch on Free or 365 days after fetch on paid plans; a fresh fetch starts a new clock. Normalized delivery facts and published reports follow the workspace lifecycle. Production database backup configuration is up to 14 days, staging is seven days, and blob soft-delete is seven days. A real isolated staging restore has tested workspace deletion replay; this does not establish a general recovery SLA or prove every external provider’s erasure.
ScopeWorth supports project, client and team delivery reporting. It does not collect keystrokes, screenshots, webcams or background activity timers. Processing scope depends on the connected source and enabled feature. Review integration permissions before connecting a source, and do not submit sensitive data that the reporting purpose does not require.
SSO/SAML is not available. ScopeWorth has not completed a SOC 2 Type II attestation, is not ISO 27001 certified and does not claim GDPR certification. An implemented control is not the same as an independent audit or a completed live-provider acceptance test.
Send reproducible details to [email protected]. Avoid sending credentials or unnecessary Customer Content. We investigate reports and communicate confirmed incidents through the applicable customer agreement.
The published DPA specifies initial breach notice within 24 hours of awareness, or sooner where required by law. Its publication and customer acceptance status is shown on the DPA page. This does not establish an uptime or incident-resolution guarantee. Privacy questions go to [email protected].