Security

• Passwords are hashed, never stored. Nobody here can read yours, including us.
• Sessions are checked against the live account on every request. When you remove someone from your workspace, their access ends on their next action — not whenever their session happens to expire.
• Every permission is enforced on the server. Hiding a button in the browser is a courtesy; the route is the boundary.
• Removing a colleague revokes their sessions immediately and moves them out of your workspace — without touching the account they own.

Invitation links are 256 bits of cryptographically random data. We store only a SHA-256 hash of the token, so a database leak does not hand the reader a working set of invitations — and we genuinely cannot resend the original link, only issue a new one.

Accepting an invitation deletes it. Replay is impossible by construction rather than by a flag someone has to remember to check. Links expire after seven days, and an invitation is bound to the address it was sent to — forwarding it to a colleague does not let them join in your place.

• All traffic is served over TLS. There is no unencrypted route into the product.
• The database is hosted on managed infrastructure with encryption at rest and automated backups.
• Uploaded client files are stored privately and are never publicly addressable.
• Card details never touch our servers — the payment provider handles them directly.

Discovery conversations are sent to Anthropic's API to produce the brief, the verdict and the proposal draft. They are not used to train models, and they are not retained beyond what is needed to serve the request.

Your pricing intelligence is calibrated against your own closed projects only. Nothing crosses between workspaces.

Being straight about this is more useful to you than a badge would be:

• We are not SOC 2 or ISO 27001 certified. If your procurement process requires it, we are not there yet.
• We do not currently offer SSO or SCIM provisioning.
• We do not have a formal bug bounty programme — but we will always credit a good-faith report.

If you think you have found a vulnerability, write to security@scopeloop.com. Tell us what you found and how to reproduce it. We will confirm receipt, keep you updated, and we will not take legal action against anyone reporting in good faith.