> Index of every Scallor page for agents: https://scallor.com/llms.txt
> Human version of this page: https://scallor.com/trust

# Scallor trust and compliance

> Scallor handles sensitive client engagement data. This page states what is enforced today and what is on the roadmap. Scallor holds no certifications yet.

## What we follow today

CCPA, CASL, PIPEDA, OWASP Top 10, and AES-256 at rest with TLS 1.3 in transit. We follow the guidance and best practices of these; we hold no certifications.

## On the roadmap

SOC 2 Type I, ISO 27001, ISO 42001. Quebec Law 25 and PIPA (Alberta and BC) are planned with a Canadian data region. GDPR is scoped but not adopted.

## Security controls

- **Tenant isolation:** every database table enforces row level security, so an organisation can only access its own data
- **Encryption:** AES-256 at rest and TLS 1.3 in transit, backups included
- **Defence in depth:** every API request verifies authentication and scopes queries to the organisation
- **Audit logging:** access and key events are logged (user, action, entity, timestamp) in append-only logs
- **No PII in application logs:** logs hold event types and entity IDs only
- **Role-based access control:** every action is scoped to the user's role
- **Vulnerability scanning:** automated on every change, high-severity issues triaged within one business day
- **Incident response:** we detect, investigate and notify. Customers are notified of any confirmed breach of security safeguards affecting their data without undue delay and in any event within 48 hours, as our customer agreements require, and we keep a record of each incident for 24 months

## AI and customer data

Scallor's AI runs on OpenAI and Anthropic under their API terms, which exclude API customer data from model training. Scallor manages the keys and lists both as subprocessors. No model is trained on customer data. Under each provider's published policy, inputs and outputs are retained for up to 30 days for abuse monitoring and then deleted. Scallor holds no bespoke or zero-retention arrangement with either provider.

## Data residency

Customer data is hosted in AWS us-east-1 (US East, N. Virginia). Canada, UK/EU and Asia-Pacific regions are planned based on customer demand. Storage location is disclosed in every customer agreement.

## Planned

- Enterprise SAML and OIDC federation. Today sign-in uses Google, Microsoft, or a one-time email link.
- Independent penetration testing before general availability, then annually.

Full detail: https://scallor.com/trust