1. Shared responsibility
Scope Cloud provides platform controls; users and workspace administrators remain responsible for strong credentials, trusted devices, appropriate permissions, authorised uploads, exports and internal policies. Security is a continuing risk-management process, not a guarantee.
2. Authentication
The application supports email-and-password accounts, email verification codes, password reset and optional Google sign-in through Base44 authentication. Protected application routes require an authenticated session. Authentication tokens are stored in browser storage and removed through logout or expiry mechanisms.
4. Data handling
Application records and uploaded content are handled through Base44 platform services. Transactional email is delivered through Resend. Secrets used by backend functions are held outside public frontend code. Scope Cloud does not publish unverified claims about encryption configuration, backup frequency or data-centre certification.
5. Application safeguards
Confirmed measures include protected routing, server-side authentication checks for backend functions, required-field validation, limited public-form schemas, private secret storage and consent records. Public inputs are treated as untrusted and communication routing removes basic angle-bracket markup before email delivery.
6. Availability and recovery
No public uptime SLA, independent status monitor, disaster-recovery certification or formal recovery objective is currently claimed. Important professional records should also be retained in an appropriate independent system. Verified service notices are published on the Status page or through support channels.
7. Certifications and assurance
Scope Cloud does not currently claim ISO 27001, SOC 2, Cyber Essentials, PCI DSS certification, a completed independent penetration test or any equivalent assurance unless a dated report is supplied directly under appropriate terms.
8. Protecting your account
- Use a unique password and protect access to the account email.
- Do not share verification codes or personal credentials.
- Sign out on shared devices and remove former workspace members promptly.
- Verify recipients and permissions before sharing project information.
- Report unexpected login, password-reset or workspace activity promptly.
9. Reporting a vulnerability
Send a clear report to security@scope.cloud, including the affected page or service, reproduction steps, potential impact and a safe contact method. Do not access data beyond what is necessary, disrupt service, use social engineering or publicly disclose before a reasonable remediation opportunity.
10. Incident response
Suspected incidents are assessed using available platform, account and communication records. Scope Cloud may contain access, preserve evidence, contact providers and notify affected users or authorities where legally required. Details will be shared proportionately to avoid increasing risk.