Your work, protected and yours to keep

Your data is yours, and you can take it with you

We do not hold your work hostage. Your scopes, snippets and documents belong to you.

• Export anytime. Documents export as branded PDFs, and your combined task lists export as

Markdown; structured data can be exported as CSV where it applies.

• Leave cleanly. If you cancel, you keep access until the end of your paid period and can export

your work first. We set out retention and deletion in the privacy policy.

• We are the processor, you are the controller. For the client data you put into ScopeDeck, you

control it and we process it on your instructions, formalised in our Data Processing Agreement.

Tenant isolation between Spaces

Each customer's data lives behind its own Space boundary. Access is scoped to the Space and the roles you grant, so one customer's scopes are not reachable from another's. Within a Space, roles and permissions control who can view, edit and send.

E-signature audit trail

Native e-signature is designed to stand up as a record of what was agreed.

• Audit certificate. Each completed signature produces an audit trail of signers, signing order

and timestamps.

• Immutable accepted snapshot. Acceptance freezes exactly what was signed, so the agreed Scope

cannot be quietly altered afterwards.

• Amendment flow. Changes after acceptance are captured as amendment and diff documents in

version history, not silent edits.

Hosting, encryption and backups

• Hosting. ScopeDeck runs on managed cloud infrastructure using a PostgreSQL database

(via Supabase) with content delivered and protected through Cloudflare. Providers are named generically here and may change; see the privacy policy and DPA for the current sub-processor list.

• Encryption. Data is encrypted in transit (HTTPS/TLS) and at rest by the hosting platform.
• Backups. The database is backed up on a regular schedule so your work can be recovered.

Access control and accountability

• Roles and permissions govern what each teammate can do inside a Space.
• Safe multi-user editing uses version checks and conflict handling, so concurrent edits do not

silently overwrite each other.

• Audit history records key changes, so you can see who did what.

Certifications, where we honestly stand

We are not going to claim certifications we do not hold. We are working towards formalising our security practices and will state clearly on this page if and when we achieve specific certifications or attestations. If you have a compliance question for a procurement process, contact us and we will answer plainly.