ScopeCheck — Security & Trust

At a glance

How we protect your data

Six commitments that define how ScopeCheck treats every estimate you upload.

🛡️

Personal data is redacted before AI ever sees it

Names, street addresses, phone numbers, and claim & policy numbers are stripped from your estimates on the way in — before any analysis runs. The AI works on scope and dollars, not identities.

🗂️

Your files aren't kept

Uploaded estimates are processed transiently and not retained as raw files. We keep the reconciliation result you create — not a library of your source documents.

🏢

Strict tenant isolation

Every request is checked against your organization before any data is read or written. One company can never see another's claims — enforced in the application and backstopped at the database.

🔐

Encrypted, everywhere

All data is encrypted in transit (TLS) and at rest, on SOC 2-attested infrastructure. Sign-in is passwordless — a one-time emailed code — so there's no password to steal.

💳

We never touch your card

All payments run through Stripe. Card details go straight to Stripe and are never stored on ScopeCheck's systems.

🤖

AI with guardrails

Analysis uses a leading U.S. AI provider under commercial terms that prohibit training on your data. Combined with up-front redaction, your claims never become someone's training set.

The detail

Data handling & privacy

Redaction at the door. Estimate text is extracted and personally identifiable information — names, street addresses, phone numbers, claim numbers, policy numbers — is removed before the document reaches any AI model. City, state, and ZIP are retained only where needed for pricing accuracy.
Transient file handling. Raw uploaded PDFs are used to produce your result and are not retained as a stored file library. Scanned-document pages used for OCR are held only for processing and swept automatically.
You own your output. The reconciliation and estimate-review results you create are yours; you can close or delete them.
Data residency. Data is hosted in the United States on our infrastructure providers.

Access control & authentication

Passwordless sign-in. Users authenticate with a one-time code sent to their email — there is no password database to breach.
Least-privilege roles. Within a company, members and admins have scoped permissions; platform-staff access is role-restricted and separate from customer data operations.
Multi-factor authentication is enforced on all administrative and infrastructure accounts (hosting, database, payments, source control).
Session integrity. Changing accounts or signing out immediately invalidates other open sessions in the same browser — protecting shared-device use.

Infrastructure & monitoring

SOC 2-attested providers. Our hosting, database, payments, and AI subprocessors each maintain their own SOC 2 attestations (see the table below).
Encryption in transit and at rest across all services.
Automated daily backups of our primary database.
Tested continuously. The application ships behind an automated test suite of 2,000+ tests, with adversarial security review on any change that touches billing or tenant boundaries.
Audit trails. Billing and account events are recorded to an immutable log.

Subprocessors

Who we rely on

ScopeCheck uses a small set of established, security-attested providers. Their compliance reports are available to enterprise customers under NDA on request.

Provider	Purpose	Compliance
Vercel	Application hosting	SOC 2 Type II
Supabase	Database, authentication, file storage	SOC 2
Stripe	Payment processing	SOC 2 / PCI DSS Level 1
Anthropic	AI document analysis	SOC 2 Type II

Using SOC 2-attested infrastructure secures the layers those providers manage. ScopeCheck implements and is responsible for its own application-level controls — the practices described on this page.

Compliance

Where we stand on SOC 2

ScopeCheck is built to SOC 2 principles today — least-privilege access, encryption, monitoring, tenant isolation, and vendor management are all in place — and we operate on SOC 2-attested infrastructure. A formal SOC 2 examination is on our roadmap and we pursue it in step with enterprise customer needs. For procurement teams evaluating us now, this page plus a completed security questionnaire is our standard package; reach out and we'll turn one around quickly.

Talk to us about security

Security questionnaire, subprocessor reports under NDA, or a specific control question — we're responsive and we don't hide the ball.

Email security@scopecheck.com

security@scopecheck.com

This page describes ScopeCheck's security practices as of the date shown and is provided for informational purposes; it is not a warranty or a contract. Compliance statuses of third-party providers are maintained by those providers. For contractual data-protection terms, see our Privacy Policy and Terms of Service.