Security
What ScopePaid does — and doesn’t — do with your data.
High-level product security practices for freelancers evaluating ScopePaid. This page is not a certification, audit report or guarantee of perfect security.
Shared responsibility
Account holders remain responsible for the accuracy of content they publish, how they share approval links, and the devices they use. We do not claim SOC 2, ISO 27001, HIPAA, guaranteed uptime or penetration-test results we have not evidenced.
Implemented today
Available now- Secure authentication via Clerk
- Server-side authorization for workspace actions
- Deny-by-default database access with row-level controls
- Workspace-isolated project and approval records
- Encryption in transit (HTTPS)
- Hashed public approval tokens (raw token not stored)
- Approval link expiry, revocation and regeneration
- Immutable decided approval snapshots
- Append-only activity and approval event history for supported workflows
- Rate limiting on sensitive public and authenticated endpoints
- Security-focused HTTP headers
- Secrets kept server-side (service credentials are not shipped to the browser)
- No bank access and no client payment-credential storage in the current product
- No website-builder credentials required
In development / not claimed
In development- PDF export of approval records
- Formal e-signature / legal-signature frameworks (not claimed today)
- Self-serve account export and deletion tooling
Logging and incidents
We retain application and security-relevant logs as needed to operate and protect the service. If you believe you have found a vulnerability, please report it responsibly — do not exfiltrate customer data or disrupt the service.
Responsible security reporting
Email security@scopepaid.com with topic “Security report”, or use the Contact form. Include steps to reproduce and avoid sending passwords, API keys or unrelated personal data.
ScopePaid provides workflow tools for documenting scope changes and project decisions. It does not provide legal advice, guarantee payment or process project payments. AI-assisted analysis is optional and requires user review.