Trust and security

Written for a security reviewer rather than a buyer. Where a control is in place we describe it; where it is not, we say so — a page that implies certifications we do not hold wastes your time and ours.

Last reviewed 21 October 2026

Isolation

Tenant isolation is enforced by the data layer, not by application code remembering to filter. A managed database is a schema with its own role, granted that schema and nothing else: a tenant holding their own credential cannot read another tenant’s rows, the platform’s own tables, or the authentication schema, and each of those is a test rather than a claim.

Credentials

  • ·Access tokens and database passwords are stored as hashes. We cannot show you yours again, which is the point — rotation is the recovery path.
  • ·Stored third-party credentials are encrypted at rest with a key held outside the database.
  • ·Sessions are signed, HTTP-only and secure-flagged. Changing a password requires the current one, because a session cookie is not proof of identity.
  • ·An unknown account and a wrong password are indistinguishable in our responses.

Attribution

Administrative actions are written to an audit log with the actor, the action, the target and the request context. Authentication events — including failed password changes — are recorded separately. Neither log is reachable from a customer session.

Boundaries

  • ·The administrative surface is reachable only by direct URL, is never linked from the customer application, and re-checks the caller’s role on every request.
  • ·Internal operational tooling answers "not found" rather than "forbidden" to a non-administrator, so its existence is not disclosed either.
  • ·Public endpoints are built to return the minimum: specifications and prices, not the mechanics behind them.

Platform status

The status page probes each component when you load it, rather than reporting a cached verdict. An indicator that defaults to healthy is worse than none.

What we have not certified

We do not currently hold SOC 2, ISO 27001 or equivalent third-party attestation, and we will not imply otherwise to win a review. If your procurement process requires one, tell us at security@scaleai.markets — we would rather know where that line is for you than discover it late.

Reporting a vulnerability

Write to security@scaleai.markets. We acknowledge within one business day. Testing your own workloads needs no permission; testing the platform does, and we grant it readily — see the acceptable use policy.