Security review, self-serve.
Pre-filled SIG Lite, CAIQ Lite, and VRM questionnaires, plus a one-page posture overview. Every answer reflects Scope's actual current build. Items not yet in place are flagged for the post-launch roadmap (target Q3-Q4 2026), not glossed over.
TLS 1.2+ in transit (1.3 preferred). AES-256 at rest (Supabase managed Postgres). AES-256-GCM for application-layer secrets. API tokens stored as SHA-256 hashes, never plaintext.
Row Level Security on every tenant-scoped table. Cross-tenant reads blocked at the database layer, not just the application.
Bearer tokens (OAuth 2.0 access tokens and personal access tokens) bound to a single tenant. Capability-based RBAC across six roles. SSO via SAML 2.0 and OIDC.
Append-only audit log on every state-changing action: actor, IP, user agent, before and after state. Per-matter records exportable as CSV and PDF.
Pre-filled and ready for your review.
One-page posture: architecture, data flow, encryption, access control, hosting, certifications status, incident response.
Standardized Information Gathering (Shared Assessments) Lite, pre-filled across the core control families. Roadmap gaps flagged honestly.
Cloud Security Alliance Consensus Assessments Initiative Questionnaire, mapped to CSA Cloud Controls Matrix domains.
Generic VRM questionnaire covering the questions enterprise procurement teams ask outside of SIG or CAIQ.
Read-only audit of tenant isolation: every table, every Row Level Security policy, every administrative database access path classified. No present cross-tenant exposure found. Additional layered hardening planned for the post-launch roadmap.
SOC 2 Type I in preparation: security controls are in place today, and the formal audit engagement is being finalized. Type II follows after Type I issuance. HIPAA-ready controls on the claims vertical (preview), with a BAA framework in place for claims engagements at general availability. The legal vertical does not routinely process PHI. The full posture, subprocessors, insurance, and data handling live on the trust page. For anything not covered there, email security@scope.bid.