Security policy · Scout Atlas

Plain summary

We treat security as a product feature. This page lists our sub-processors, our incident response SLAs, and the rules of our vulnerability disclosure program. For the prose-level narrative, see the public security page.

Sub-processors

We notify account admins at least 30 days in advance of any sub-processor change. The live list is mirrored to /security/sub-processors.json.

Supabase — Postgres database, authentication, row-level security. EU region for European clubs, US region available on request.
Vercel — Application hosting and edge delivery for the marketing site and authenticated app shell.
Stripe — Payment processing for self-serve trials. PCI-DSS Level 1.
Resend — Transactional email (magic links, account notifications, digest emails).
Cloudflare — DNS and DDoS protection.

Incident response

Detection. Real-time alerting on authentication anomalies, error rate spikes, and database access patterns. Founder-on-call rotation 24/7.
Triage. Severity classified inside 30 minutes (S1/S2/S3) per a public runbook.
Disclosure. Affected clubs notified inside 72 hours of confirmed incident affecting their data, with technical detail.
Post-mortem. Written post-mortem published to affected clubs inside 14 days, with corrective actions and timelines.

Vulnerability disclosure

We run an open program. Email security@scoutatlas.co with steps to reproduce and (where applicable) a proof-of-concept payload.

We acknowledge receipt inside 48 hours.
We commit to a remediation timeline inside 7 days, scaled to severity.
We credit researchers in the changelog when patches ship — with permission.
We commit not to pursue legal action against good-faith researchers who follow the disclosure program rules.

Out of scope

The following are explicitly out of scope for the disclosure program: denial-of-service attacks, social engineering of staff, vulnerabilities in third-party services that are already publicly disclosed, and physical-security testing.

Encryption

TLS 1.3 in transit, modern cipher suites only, HSTS preload.
AES-256-GCM at rest for sensitive columns.
End-to-end encryption for Deal Room messages with per-room keys we cannot read.
Per-club key envelopes for opt-in private streams (GPS, biometrics, medical).

Audits

SOC 2 Type II readiness audit — Q4 2026.
Independent penetration test — annually from year 2 (2027).
Quarterly internal review of access permissions and audit logs.