Scallor is built for firms that handle sensitive client engagements. Security and compliance are foundational, not afterthoughts.
5
Standards we follow
0
PII in app logs
48h
Incident notice
We follow five standards today. Three certifications are on our roadmap, and three further regulations are planned, two of them arriving with our Canadian region. We hold no certifications yet. The active items are the guidance and best practices we follow now, not audited or certified positions.
Active today
Guidance and best practices we follow now
CCPA
California Consumer Privacy Act
CASL
Canadian Anti-Spam Legislation
PIPEDA
Personal Information Protection (Canada)
OWASP Top 10
Secure application development standard
AES-256 and TLS 1.3
Encryption at rest and in transit
On our roadmap
Certifications we are working toward
SOC 2 Type I
AICPA Trust Services Criteria
ISO 27001
Information security management aligned
ISO 42001
AI management system (emerging standard)
Planned
Scoped, not yet adopted
GDPR
EU General Data Protection Regulation
Quebec Law 25
Quebec privacy regulation
PIPA Alberta & BC
Provincial privacy regulations
Six controls, layered like the product itself: isolation at the row, encryption on the wire, and an audit trail that is append-only.
Row Level Security
Every database table enforces tenant isolation at the row level. Your organisation can only access its own data, enforced by the database engine.
Encryption at rest and in transit
All data encrypted with AES-256 at rest and TLS 1.3 in transit. Backups encrypted to the same standard.
Defence in depth
Every API request verifies authentication, extracts your organisation, and scopes queries. Multiple layers, no shortcuts.
Append-only audit logging
Access and key events are logged in append-only logs: user, action, entity, timestamp.
No PII in application logs
Server logs contain event types and entity IDs only. Names, emails, and project details never appear in application logs.
How we handle AI
Your AI runs on OpenAI and Anthropic under their API terms, which exclude API customer data from model training. We manage the keys and list both as subprocessors, so there’s nothing for you to set up, and no model ever learns from your projects.
We never train AI models on your data. Our AI subprocessors (OpenAI and Anthropic) are engaged on their standard API terms, which exclude API customer data from model training. Under each provider’s published policy, inputs and outputs are retained for up to 30 days for abuse monitoring and then deleted. We hold no bespoke or zero-retention arrangement with either provider.
Granular permissions for owners, delivery leads, and team members. Every action is scoped to a user’s role within their organisation.
Automated dependency and code scanning runs on every change. High-severity issues are triaged within one business day.
We detect, investigate and notify. Customers are notified of any confirmed breach of security safeguards affecting their data without undue delay and in any event within 48 hours, as our customer agreements require, and we keep a record of each incident for 24 months.
Your team can sign in with Google, with Microsoft, or with a secure one-time email link. No passwords to store or reset. Enterprise SAML and OIDC federation, where your IT team connects its own identity provider and enforces its own policy, is on our roadmap for the post-launch enterprise tier.
Independent penetration testing planned before general availability and annually thereafter. Reports available on request under NDA.
All customer delivery data is hosted on secure infrastructure in the AWS US East region. The same security controls apply to every customer, wherever they are located.
Every customer gets the same security controls wherever they are located, and storage location is disclosed in every customer agreement.
We are transparent about every vendor with access to customer data. None train models on your data, and all are bound by their standard data processing agreements.
20
Vendors
0
Train on your data
18/20
Under DPA
Database hosting & authentication. Primary store for all customer data.
Application hosting & deployment. Serves the app; no persistent data store.
Underlying cloud infrastructure that Supabase and Vercel run on. We hold no direct relationship; listed for transparency about where data physically sits.
DNS and edge network for scallor.com. Processes request metadata and visitor IP addresses in transit. No customer application data.
Hosting for the scallor.com marketing site. Server access logs only. The product itself does not run here.
AI features under OpenAI’s standard API terms, which exclude API customer data from model training.
AI features under Anthropic’s standard API terms, which exclude API customer data from model training.
Transactional email delivery: invites, notifications, sign-in links.
Aggregated website usage measurement on scallor.com. Analytics cookies are set only after you accept in the cookie banner. Not used in the platform.
Heatmaps and session replay on scallor.com. Loads only after analytics consent. Not used in the platform.
Our CRM. Stores enquiries and estimates submitted through forms and resources on scallor.com, such as the ROI calculator, so our team can respond. Hosted in Canada.
Source code hosting & CI/CD. Never receives customer data.
Electronic signature and contract execution. Captures signatory name, email, IP address, signature and the executed agreement.
Sales prospecting. Processes prospect and lead contact details for our own outbound activity. Never receives customer data and is not a subprocessor for the platform.
Subscription billing and invoicing. Holds billing contact and payment details. Never receives project data.
Error tracking & monitoring. PII scrubbed before events leave the app.
Dependency & code vulnerability scanning. Never receives customer data.
Email, calendar and document storage used to deliver and support engagements. May hold customer and prospect contact details, correspondence, and documents shared with us. Not used to train Google models.
Video conferencing for onboarding, delivery reviews and sales calls. Captures participant name, audio, video and meeting metadata. Cloud recording is not enabled on our account.
Meeting recording and transcription, used only for sessions where recording is agreed. Processes call audio, transcripts and participant details. The provider does not permit a model provider to train on session content.
See our Privacy Notice and Cookie Policy for how this maps to your rights.
Your message goes straight to the people building Scallor.
Rather talk it through?
30 minutes with the founder. 1 of 3 founding spots open.
Price my margin leak