Security overview

1.Where Scale Suite runs

Scale Suite runs on Cloudflare: the site, our server code and our main data store, Cloudflare Workers KV. Cloudflare encrypts every value stored in Workers KV at rest with AES-256. Video calls use Supabase only to connect browsers to each other, and call audio and video go directly between the browsers. See Subprocessors.

2.Encryption

• In transit: every connection uses HTTPS, and browsers are told to use only HTTPS for a year (HSTS, including subdomains).
• Your workspace: before we store it, we encrypt it again with AES-256-GCM, using a separate key for each account derived from a server secret.
• Bank connections: the access token from Plaid is sealed with AES-256-GCM using its own key before it is stored. A copy of our data store alone does not reveal it.
• AI memory: encrypted in your browser with a key your browser keeps and will not export. This protects it on that device. It is not end to end encryption.

3.Signing in

• Scale ID ("Continue with Scale") offers passkeys, one time email codes, passwords, and Google or Microsoft sign in. We recommend passkeys.
• Passwords are never stored. We keep a salted hash made with 300,000 rounds of PBKDF2 SHA-256.
• New passwords are checked against known leaked passwords. Only the first five characters of a scrambled version of the password leave our server, never the password.
• Starting a sign in answers the same way whether or not an email has an account, so it cannot be used to find who has one.
• Sessions end after 7 days without use, and after 30 days at most. Session cookies cannot be read by page scripts.
• Sign in requests are rate limited and checked against cross site request forgery.

Not offered yet: authenticator app or text message two step codes for password sign in. [Decision for Cameron: add two step codes, or keep recommending passkeys.]

4.Payments

Card numbers and bank details for Pay are entered in Stripe's own secure fields and go straight to Stripe. They never reach Scale. Scale keeps the card brand and last four digits only. Messages from Stripe are checked with Stripe's signature, refused if more than 5 minutes old, and handled only once, so a copied message cannot be replayed. Bank connections are read only, and you sign in on your bank's or Plaid's screen, so Scale never sees your bank login.

5.AI

The server checks each person's role before AI reads any data, so owner only information stays owner only. Email, documents and page content are treated as data, not instructions. Our AI logs record what happened, like the model, tools and timing, but never the question, the answer or your content, and people are identified only by a scrambled ID. AI requests are rate limited. See the AI policy.

6.Web protections

Every page tells browsers not to let other sites frame it, not to guess file types, and to share little about where a visitor came from. Camera, microphone and screen sharing are allowed only for this site, for Video. A full content security policy is being tested in report only mode before we enforce it. Apple Wallet pass updates are checked with a token for each pass.

7.Access by people at Scale

Support access to your account needs the owner's grant, as the AI policy describes. Each grant is a signed, time limited code that our server checks on every support visit, and turning access off ends it at once. Support sees settings with card, phone and passkey details removed. Grants, visits and ends are written to an append only log, chained with SHA-256 so a changed entry shows.

Consent and billing records, like AI choices, renewal agreements and cancellations, are kept in the same kind of append only log.

[To confirm by Cameron before launch: who at Scale and which contractors can reach production systems, that their accounts use passkeys or two step sign in, and that each has signed a confidentiality agreement.]

8.Not in place yet

We want to be clear about what we do not have yet:

• No SOC 2 or ISO 27001 report. Our main providers, such as Cloudflare and Stripe, have their own.
• No independent penetration test yet. [Decision: test before launch.]
• No separate backups beyond what our providers keep. [Decision: add backups, and say here how long they are kept.]
• A written incident response plan. [To be written before launch.]
• No bug bounty program.

9.If something goes wrong

If a security incident affects your personal information, we tell you without undue delay and as the law requires, and we help you meet your own duties, as the Data processing addendum describes.

10.Your part

Use a passkey. Invite only the people who need access, and give them the lowest role that works. Remove people who leave. Do not share sign ins. Keep your devices updated and locked.

11.Report a security problem

Email [security@scalembs.com, to be set up] with what you found and how to reproduce it. Please give us a reasonable time to fix it before telling others, do not access or change other people's data, and do not disrupt the service. We will not take legal action against good faith research that follows these rules. [Mike: confirm this safe harbor wording.]

12.Contact

Questions about this page: legal@scalembs.com, or by mail to Scale Modern Business Solutions LLC, 2415 San Ramon Valley Blvd, Suite 4, San Ramon, CA 94583.