SECURITY
How we look after your data
Where it lives, who can reach it, how machine access is scoped — and, just as plainly, what we do not have yet.
Where your data lives
- The application and its Postgres database are hosted in Frankfurt, in the European Union.
- Traffic is encrypted in transit with TLS, and the database is encrypted at rest by its provider.
- We never delete measurements on our own: a day that was not measured cannot be measured later. When you delete a project or close a workspace, its data is deleted within 30 days.
- You can export every screen as CSV at any time, without asking us.
Signing in
- There are no passwords to leak or reuse. You sign in with Google or with a one-time link sent to your email.
- Invitations are single-use links, stored only as a hash.
Who can see what
- Every read of product data checks that you belong to the workspace that owns it. A project you do not belong to returns the same “not found” as one that does not exist, so its ID is not confirmed to anyone.
- Three roles: owner — everything, including billing; admin — everything except billing; member — reads the data, cannot start paid work.
- Roles are enforced on the server, not only in the interface. A member who finds a hidden button gets a refusal, not a charge.
MCP and API access
- The MCP server uses OAuth 2.1 with mandatory PKCE. A token is scoped to one workspace and to read or read-and-write.
- Access tokens expire after 1 hour; refresh tokens after 60 days. Tokens are stored only as a hash.
- API keys are shown once, when created, and stored only as a SHA-256 hash. You can revoke them at any time.
- Every tool that changes something — adding or removing a prompt, starting an agent task — first returns a plan and does nothing until it is confirmed.
The agent
- It never publishes. Everything it writes is saved as a draft in your workspace.
- It runs under the credit ceiling you set, and every session is recorded with what it read and what it cost.
Payments
- Paddle is our Merchant of Record. Card details are entered in Paddle's checkout and never reach our servers.
Your data and AI models
- We do not use your prompts, measurements or agent sessions to train models of our own.
- Answers are analysed and the agent runs on a commercial AI model provider whose terms do not allow training on data sent to it.
Abuse protection
- Public forms — the free scan and the contact form — are protected by bot detection and rate limits per IP address, stored as a salted hash rather than the address itself.
What we do not have yet
We are not SOC 2 or ISO 27001 certified, and we do not offer SSO/SAML or SCIM today. If your procurement needs them, tell us before you buy — on a custom plan we will answer your security questionnaire and say which items we can meet and which we cannot.
Talk to us about a custom planFound a vulnerability?
Write to support@getscorra.com with the steps to reproduce it. Please give us a reasonable time to fix it before making it public. We do not take legal action against good-faith research.