Trust & security
Security at Scope
How we protect data across our infrastructure, devices, and team.
Last updated October 2026Questions? hello@scopelabs.com
Data protection & encryption
Data is encrypted at rest and in transit, backed up to separate servers, and protected on the devices we work from.
Encryption at rest
AES-256Our data is stored in a Supabase database encrypted with 256-bit AES, protected by rotating master keys.
Encryption in transit
HTTPSWe use HTTPS for secure communication with our servers.
Redundant backups
Supabase stores a backup copy of our data on separate servers in case of an incident.
Encrypted endpoints
FileVault 2Local endpoints are encrypted with FileVault 2, with keys managed by MDM.
Authentication & access
Database rules govern who can access data, and our primary communication systems and file repositories sit behind single sign-on and MFA.
Database-level access rules
RLSWe use Supabase Authentication with secure database rules, including robust row-level security (RLS) policies and minimal admin access.
Single sign-on with MFA
SAML 2.0SAML 2.0–based SSO behind app-based multi-factor authentication is in production for our primary communication systems and file repositories.
Monitoring & detection
Error monitoring and managed endpoint detection help us catch issues early.
Error handling & monitoring
Error handling and monitoring are set up to detect vulnerabilities early and fix them before they can become a larger issue.
Managed endpoint detection
24/7 EDRAll local endpoints are equipped with a managed endpoint detection and response (EDR) solution with 24/7 monitoring.
Industry standards & governance
Security is built into how we write code, grant access, handle data, and run our corporate IT.
Code review & triage
Code reviews confirm we follow industry-standard best practices, and a robust triage system ensures bugs are patched in a timely fashion.
Least-privilege access
We practice the principle of least privilege when granting internal access to data.
Data minimization
PIIWe collect as little personally identifiable information as possible and hash sensitive information when deemed necessary.
NIST Cybersecurity Framework
NIST CSFScope Labs adheres to the NIST Cybersecurity Framework for its corporate IT infrastructure, with a Steering Committee alongside our IT partner that meets regularly to review and discuss our IT roadmap.
