Security
How we protect your workspace and your clients’ data.
Credit repair runs on some of the most sensitive data a person has. This page describes what we actually do to protect it, in plain language. If something here ever stops being true, we change the page.
What we do not claim. SCAIL does not currently hold a SOC 2 report, ISO 27001 certification, PCI DSS certification or HIPAA attestation. We follow the practices described below, and we will say so here when an independent audit has been completed, not before.
Encryption
- Every connection uses TLS (HTTPS). Browsers are told to refuse plain HTTP for our domains (HSTS).
- Our database and file storage run on Supabase, hosted on Amazon Web Services in the US, and are encrypted at rest.
- On top of that, the most sensitive fields (full Social Security numbers, dates of birth, and credit-monitoring and bureau login credentials) are encrypted again inside the database with a separate key, and are decrypted only on the server.
- Screens show the last four digits of an SSN. A full value is revealed only to an authorized workspace role, and every reveal is logged.
Workspace isolation
- Each credit-repair company is its own workspace. Postgres row-level security on every table that holds customer data limits each row to the workspace that owns it.
- Database triggers refuse a write that does not carry a workspace, and an automated check in our build fails if a new table or background job could read across workspaces.
- Clients see only their own file. Referral partners see only their own referrals.
Sign-in and access
- Two-step sign-in with an authenticator app is available to every team member, and a workspace owner can require it for the whole team.
- Team roles with specific permissions, so staff can be given only what their job needs.
- Optional sign-in hours, so team access can be limited to the hours a workspace chooses.
- We never display or email a password. Resets happen only through a secure reset link.
Audit trail
- Access to sensitive fields, such as revealing a full SSN, is written to an audit log with who, what and when.
- Workspace owners can review their own audit trail inside the console.
Documents
- IDs, credit reports and letters are stored in a private storage bucket, never a public one.
- Files open through signed links that expire. Most expire within an hour, and share links an operator creates expire on the schedule they choose and can be revoked.
Payments
- We do not store card numbers. Card details are entered directly with Stripe or with the payment processor a workspace connects, and stay with that processor.
Backups and availability
- The database is backed up automatically every day, and daily backups are kept for 7 days.
- Every part of the platform is checked every 10 minutes, and the results and any incidents are public on our status page.
Your data, and leaving
- A workspace can export its data at any time, without asking us and without charge.
- After a workspace closes, its data stays exportable for 90 days and is deleted or de-identified within 180 days, unless the law requires us to keep it longer. These commitments are in the SCAIL Platform Services Agreement.
Reporting a security issue
If you believe you have found a vulnerability, email support@scailapp.com with “Security report” in the subject and enough detail for us to reproduce it. We will acknowledge it, keep you updated while we fix it, and we ask that you give us reasonable time to fix it before sharing it publicly. Please do not access, change or download data that is not yours while testing.