Security & Data Policy

1. Overview

Security is foundational to ScanCompliant. Our customers trust us with proprietary marketing content, business information, and user data. We take that responsibility seriously and implement layered security controls across our infrastructure, application, and operations.

This document describes our security posture as of the date above. For enterprise due diligence requests or vendor security questionnaires, contact support@scancompliant.com.

2. Infrastructure Security

Hosting & Cloud

Our platform runs on Google Cloud Platform. GCP data centers maintain physical security controls including 24/7 security personnel, biometric access, and surveillance systems. GCP holds the following certifications: SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS, and FedRAMP.

Network Security

• Web application firewall (WAF) protects against common web threats including OWASP Top 10 vulnerabilities
• DDoS protection at the network and application layer
• Network segmentation separates production, staging, and development environments
• All inbound and outbound traffic is logged and monitored
• SSH access to production systems requires key-based authentication and MFA

Availability & Backups

• Target uptime: 99.9% monthly
• Automated database backups every 6 hours with 30-day retention
• Point-in-time recovery available for the past 7 days
• Backups are encrypted and stored in a geographically separate region
• Disaster recovery procedures are documented and tested quarterly

3. Data Protection

Data Isolation

Each customer's data is logically isolated at the database level. No customer can access another customer's scan data, reports, or keyword libraries. Isolation is enforced at both the application and database query levels.

Content Submitted for Scanning

URLs, documents, images, and other content you submit for compliance review are:

• Processed in isolated compute environments
• Stored encrypted at rest in your private data partition
• Retained for 12 months then deleted (or sooner if you delete them)
• Never shared with other customers or used for training purposes in identifiable form
• Accessible only by you and ScanCompliant employees with a legitimate operational need

Clara AI Conversations

Clara AI conversations are stored for 90 days to enable conversation history within the platform. They are encrypted at rest, not used to train external AI models, and not reviewed by employees unless you report an issue that requires investigation.

4. Access Controls

Employee Access

• Access to production customer data is limited to engineers with an operational need
• All employee access requires MFA and is provisioned on a least-privilege basis
• Access is reviewed quarterly and revoked immediately upon employee offboarding
• Background checks are conducted for all employees with access to production systems

User Access

• User sessions use secure, httpOnly, SameSite cookies
• Passwords are hashed using bcrypt with a per-user salt — we never store plaintext passwords
• Account lockout occurs after 5 consecutive failed login attempts
• Optional MFA is available for all accounts via authenticator app
• Session tokens expire after 24 hours of inactivity

5. Monitoring & Testing

• 24/7 automated monitoring of infrastructure health, error rates, and anomalous access patterns
• Annual third-party penetration testing by an independent security firm
• Regular internal vulnerability scans using industry-standard tooling
• Dependencies and third-party libraries are monitored for known CVEs and updated promptly
• Code changes undergo security review before deployment to production

6. Incident Response

We maintain a documented security incident response plan. In the event of a confirmed data breach affecting customer data:

1. Affected customers will be notified within 72 hours of discovery
2. Notification will include: nature of the incident, data affected, steps taken, and recommended user actions
3. We will cooperate fully with regulatory requirements including GDPR breach notification obligations
4. A post-incident report will be provided within 30 days describing root cause and remediation

To report a suspected security incident: support@scancompliant.com

7. Sub-Processors

We use the following third-party sub-processors in delivering our services. All are bound by data processing agreements:

Provider	Purpose	Location
Google Cloud Platform	Cloud hosting, storage, compute	United States (multi-region)
Stripe, Inc.	Payment processing	United States
SendGrid (Twilio)	Transactional email delivery	United States
Google Analytics	Website usage analytics	United States
Intercom	Customer support chat	United States
OpenAI / Anthropic	AI model powering Clara AI	United States

We will notify customers of material changes to our sub-processor list with at least 30 days' notice.

8. Data Retention & Deletion

• Account data: retained for the subscription term plus 90 days
• Scan content and reports: retained for 12 months, then automatically deleted
• Clara AI conversations: retained for 90 days
• Billing records: retained for 7 years (legal requirement)
• Audit logs: retained for 2 years
• Backups: retained for 30 days then purged

You may request deletion of your account and data at any time by emailing support@scancompliant.com. Account deletion is completed within 30 days. Billing records are retained per legal requirements even after account deletion.

9. GDPR & Data Processing Agreement

For customers in the European Economic Area (EEA) or United Kingdom, ScanCompliant acts as a data processor with respect to personal data contained in content you submit for review. You act as the data controller.

We are willing to enter into a Data Processing Agreement (DPA) in accordance with GDPR Article 28. Enterprise customers requiring a signed DPA should contact support@scancompliant.com.

International data transfers from the EEA to the United States are conducted under Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Responsible Disclosure Program

We appreciate the work of security researchers who help keep our platform safe. If you discover a security vulnerability in ScanCompliant, please report it responsibly:

• Email: support@scancompliant.com
• Encrypt sensitive reports using our PGP key (available on request)
• Include: description of the vulnerability, steps to reproduce, potential impact
• Do not access, modify, or delete user data during your research
• Allow us 90 days to address the issue before public disclosure

We will acknowledge all reports within 48 hours and will not pursue legal action against good-faith researchers who follow these guidelines.

11. Contact

Security concerns: support@scancompliant.com
Privacy questions: support@scancompliant.com
DPA / GDPR requests: support@scancompliant.com

---