Security

How we protect your data, in plain English — written for a busy business owner, not a security auditor.

The short version

• We never sell your data. Not to advertisers, not to brokers, not to anyone.
• We never see your card details. Stripe handles payments end to end.
• Your data is encrypted in transit and at rest.
• Nothing we write gets published automatically. You review and approve every piece of content before it goes anywhere near your website.

What we hold — and what we don't

We hold: your account details (name, email), the business information you enter, the AI answers we collect about your business, and your Prompt Score history.

We don't hold: card numbers (Stripe does), your passwords in readable form (they're hashed), or any patient or client records. Scout works with business and marketing information only — we do not process patient health information.

How the product is protected

• Encryption — HTTPS/TLS everywhere, with HSTS. Data is encrypted at rest by our managed database provider.
• Access control — every request is authorized against your organization's membership, and plan limits are enforced on the server, never in the browser.
• Authentication — email + password (hashed) or Google sign-in. Verification and password-reset tokens are stored hashed and expire.
• Input validation — all external input is validated at the boundary before it reaches our systems.
• Abuse protection — per-IP rate limits on the free checker and on sign-in attempts, to blunt brute-force and scraping.
• Browser hardening — a strict, nonce-based Content Security Policy plus the standard security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy).
• Integrity of money and jobs — inbound payment and background-job webhooks are signature-verified, and the handlers are idempotent so a replayed message can't double-charge or double-process.

Where your data lives

US-hosted managed infrastructure: Vercel (application) and Neon (PostgreSQL, US region). The full list of subprocessors — what each one does and what data it can see — is published at /subprocessors.

Most of the providers that handle your data process it under a data-processing agreement that takes effect automatically under their standard terms; we're finalizing agreements with the remaining few. A handful act as independent data controllers for their own operational data — payments (Stripe), cookieless analytics (Vercel), and maps and sign-in (Google) — under their own terms rather than ours. Our AI providers are on commercial API terms with model training turned off — your data is not used to train AI models.

Backups and recovery

Point-in-time restore on the database.

How we build

• Changes ship through pull requests with automated gates on every commit: type checking, linting, automated tests, dependency vulnerability scanning, and secret scanning.
• Secrets are never committed to source control; they're injected as environment variables and validated at boot, so a misconfigured deploy fails loudly instead of running insecurely.

Generated content

Everything Scout drafts passes through a human review gate. Nothing is published to your website automatically — you approve it, you publish it. We build content from the facts you supply; we don't invent claims about your business.

What we don't have (yet)

We'd rather tell you plainly than imply more than we have:

• We don't hold a SOC 2 report or ISO 27001 certification today. We're a small team. If you need one in order to buy, tell us — it genuinely helps us prioritize.
• We haven't commissioned an independent penetration test yet.
• We don't offer two-factor authentication on customer accounts yet.
• We don't offer SSO/SAML or bespoke security reviews at our current plans.

Everything above this section is what we actually do today.

Reporting a security problem

Found something? Email support@scoutpromptscore.com with "Security" in the subject line. We'll acknowledge within 2 business days. We don't run a paid bug-bounty program, but we're genuinely grateful — and happy to credit you if you'd like.