Security

What we store

Your workspace data: projects, scopes (modules, features, tasks, acceptance criteria), comments, project context and documents, agent memory, activity history, and the settings for your team. Account data: email, name, team membership, plan, and billing history. Card details are handled by Stripe and never touch our servers.

We do not store a copy of your repository. When you import a codebase for scoping we read it to produce a summary of the stack and structure, and keep that summary as project context. During a cloud run the repository is cloned onto a VM created for that run and removed with it.

Where agents run, and on whose keys

In your editor. Claude Code, Cursor, Codex, and other MCP clients run on your machine, on your own subscription or API key. Scope Architect only exchanges the plan and status with them over MCP. No code passes through us on this path.

Cloud runs. Each run gets its own virtual machine on Google Cloud, created for that run and torn down when it finishes. The agent inside it runs as an unprivileged user, with the credentials of the person who started the run: either their connected agent account or the team's own API key. Credentials are stored encrypted, released only to runs started by their owner, and cleared from the VM when the run ends. The result is a pull request on your repository, opened through the GitHub App installation you authorized.

Scoping and Architect Chat use the model provider configured for your workspace. On platform credits that is Google (Vertex AI). With your own keys, requests go to your provider account (Google, Anthropic, OpenAI, or xAI) and are billed there. We never train models on your content, and our providers are used under terms that do not permit training on API traffic.

Encryption and access

All traffic is over TLS. Data at rest is encrypted by our database and hosting providers. API keys and connected-agent credentials are additionally encrypted by the application before they are written, and are never written to logs in plaintext.

Access inside your workspace is by role: owners, admins, and members, with per-member capabilities for billing, API keys, MCP, and coding-tool settings. Every API request is checked against the caller's team; database row-level security enforces the same boundary underneath the application.

Scope Architect staff do not access customer workspaces except to resolve a support request you have opened, or to investigate abuse or a security incident.

Authentication

Accounts use email and password with email confirmation. Sign-in with Google and SAML single sign-on are not available yet; SAML is on the roadmap for larger teams. Agent connections to the hosted MCP server use OAuth or a per-team key you can rotate or revoke at any time from Settings.

Subprocessors

We disclose the third parties that process customer data on our behalf:

• Vercel: application hosting.
• Supabase: database, authentication, and file storage.
• Google Cloud: virtual machines for cloud runs, and Vertex AI for platform-credit model calls.
• GitHub: repository access through the Scope Architect GitHub App, only for repositories you install it on.
• Stripe: payments and invoices.
• Resend: transactional email.
• PostHog: product analytics on how the app is used. No project content is sent.
• Anthropic, OpenAI, xAI: only if you bring your own key for that provider.

Retention, export, and deletion

Your data stays in your workspace for as long as your account exists. You can export any project as JSON or Markdown from the handoff panel at any time, and disconnect agent credentials or GitHub installations yourself from Settings.

When you cancel, the workspace stays readable to the end of the paid period, then drops to the free limits. Nothing is deleted automatically. To delete a workspace and its data, email support@scopearchitect.com from an owner account; we confirm and complete deletion within 30 days, excluding what we are legally required to keep, such as invoices.

Incidents and vulnerability reports

If we learn of a security incident affecting your data we will notify the owners of the affected workspaces by email without undue delay, with what happened, what was affected, and what we are doing. To report a vulnerability, email support@scopearchitect.com with "security" in the subject; we read those first and will acknowledge within two business days.

Compliance status

We are not SOC 2 certified today. We will say so plainly in any review and share our timeline when a customer needs one. Our privacy policy covers GDPR and CCPA rights, and a data processing agreement is available on request.

Questions from IT, security, or legal: support@scopearchitect.com.