Security
How your data is protected, and a plain account of the gaps.
Last updated
ScopeDiff holds commercially sensitive things — what you agreed to build, for whom, and sometimes for how much. This page describes how that is protected and, just as importantly, what we don’t do yet. You are a technical buyer; you would find the gaps anyway, and a page that hid them would make the rest untrustworthy.
Data protection
- Encrypted in transit. All traffic runs over HTTPS (TLS). The application is served with HSTS by our host.
- Encrypted at rest. Our database and file storage providers encrypt stored data at rest.
- Row-level security. Every table enforces Postgres row-level security policies scoped to the owning account, underneath an application layer that also scopes each query to the signed-in user. The database is the backstop, not the only guard.
- Usage and consent tables are deny-all.The tables recording AI usage and billing consent have row-level security enabled with no policies at all, so they are unreachable from the browser. Only server-side code with the secret key can read or write them — which is the point: an account should not be able to delete its own audit rows.
Your signed agreement isn’t kept
An uploaded SOW is read once in memory to extract deliverables and then discarded. No copy is written to storage. Our parsing code deliberately avoids logging document text, including on the error paths where an SDK would otherwise print the whole request body.
In August 2026, before opening the service publicly, we permanently deleted every source document that predated this behavior. The storage bucket that held them is being removed entirely, so the claim is enforced by there being nowhere to put one.
GitHub access
- Your GitHub token is encrypted before it is stored and is only decrypted server-side to make a scan request.
- A scan reads pull request titles and descriptions, commit subject lines, and author usernames— and nothing else. No file contents, no diffs, no code.
- The OAuth scope we request is broader than what we use, because GitHub’s classic scopes have no read-only option for private repositories. We do not write to your repository. A fine-grained GitHub App is the correct fix and is planned. You can revoke access from your GitHub settings at any time.
Payments
Card details never touch our servers. Checkout and billing management are hosted by Stripe; we store only the customer and subscription identifiers Stripe returns.
Share links: how they work, and their limits
A published record lives at a URL containing a token of 24 bytes of cryptographically secure randomness (192 bits), generated by the database. It is not guessable and not enumerable, and shared pages are marked noindex and served with Referrer-Policy: no-referrer so the URL is not leaked to sites your client visits next.
The limitation, stated plainly. The link is the credential, and a link cannot currently be revoked, rotated, or set to expire. If a record reaches someone it shouldn’t have, the only remedy today is deleting the project — which permanently destroys the record and all its published versions.
We are not going to describe this as a feature. Link-based sharing is a deliberate trade: your client never has to create an account, which is the single most common reason these records go unread. Revocation is the obvious missing piece and it is the next thing we intend to build here.
Drafts are never reachable through a share link. Only versions you have explicitly published can be read, and the server re-checks that on every request rather than trusting the URL.
What we collect about your client
A name, if they choose to type one when marking a version reviewed. That is all. We do not log who opened a record, we do not store their IP address or browser, and we set no cookies on the shared view. There is no analytics of any kind anywhere in ScopeDiff.
What we don’t have
An honest list:
- No SOC 2, ISO 27001, or any third-party audit. We are a one-person business and have not been through one.
- No penetration test by an external firm.
- No share-link revocation or expiry, as described above.
- No customer-facing audit log.You cannot see who viewed a record, because we don’t collect it.
- No single sign-on, SCIM, or role-based access. One account owns its projects; there is no team model yet.
- No self-serve account deletion.Email us and we do it by hand, within 30 days — usually the same week.
If one of these is a blocker for you, say so — it’s useful signal about what to build next.
If something goes wrong
If we discover a breach affecting your data, we will email you promptly with what happened, what was affected, and what we are doing about it, and we will comply with California’s notification requirements.
Reporting a vulnerability
Email hello@scopediff.comwith “security” in the subject. Please give us a reasonable chance to fix an issue before disclosing it publicly. We don’t run a paid bounty program, but we will credit you if you’d like.
We won’t pursue anyone acting in good faith under this policy. Please don’t access data that isn’t yours, degrade the service, or run automated scans against production.
Related: Privacy Policy · Sub-processors