Security and your data

What protects your data

• The database refuses what no rule allows. Every table in our database has row-level security switched on. Even if a request got past our own checks, the database itself would still refuse access that no rule allows.
• Every project request checks who you are. A request to read or change a project needs a signed-in person, and we check their role in that project (owner, manager, editor, commenter or viewer) before anything is shown or changed. Deleting or restoring a project and managing invitations stay with the owner. What you may do also depends on your own plan.
• Google Calendar tokens are encrypted. If you connect Google Calendar, the access tokens Google gives us are encrypted (AES-256-GCM) before they are stored. We ask Google only for permission to create and change our own events, and we do not read the other events in your calendar.
• Secret addresses and tokens are stored as hashes. The tokens you create for AI tools and the secret address of your calendar feed are stored only as one-way hashes. We show the secret once when you create it, and we cannot read it back.
• AI tools you connect act as you, and cannot delete. An AI tool that you connect works with your own permissions, can be limited to reading or to one project, and has no function that deletes anything. You can revoke its token at any time and it stops with the next call.
• Rate limits slow down floods and scripts. Sign-up forms, AI features, comments, invitations and other public or costly actions have limits on how often they can be used, so scripts and floods are slowed down.
• Security headers on every page. Every page is sent with a strict content security policy, protection against being shown inside other websites, no content-type guessing, a restrictive referrer and permissions policy, and HTTPS-only transport (HSTS) on the live site.
• Uploaded files are private. Files you upload to a project are kept in private storage, in a folder of their own for each person, and are shown through short-lived links.
• Your project data is kept in the EU. Our database and the files you upload are hosted in the EU. Some of our providers, for example for the website itself and for the AI features, may process data outside the EU; our Privacy Policy says which and on what basis.
• Live collaboration channels are private. The channels that carry live changes, cursors and presence in a shared project are private and checked against your access rights.
• Card details never reach our servers. Payments run on Stripe Checkout. You enter your card details on Stripe's page, not ours.
• Analytics only with your consent. Analytics (Microsoft Clarity and Vercel Analytics) load only after you accept them in the cookie banner. You can withdraw that at any time from the footer.
• Error reports carry no personal data. When something breaks, the error report we receive has no user, cookies, request bodies or query strings, and secrets that appear in addresses are masked.
• You can take your data and delete your account. In Settings you can download the personal data we hold about you and delete your account. After a 30-day grace period (so a mistake can be undone) your data is deleted. Records the law makes us keep, such as invoices held by Stripe, are the exception. A project you delete stays in the trash for 30 days and is then removed for good.

What we do not have

We would rather you know than assume.

• No two-factor sign-in of our own. You sign in with Google, so Google's own protection for your account applies, including its two-step verification if you have switched it on. ScatterFlow adds no second step.
• No single sign-on (SSO or SAML) for companies.
• No audit log for customers. A project shows a short history of changes to a task, but not a full record of everything that happens in your account.
• No independent penetration test so far.
• No security certification, such as SOC 2 or ISO 27001.

Report a problem

If you find a security problem in ScatterFlow, please write to contact@scatterflow.com. Tell us what you found and how to see it, and please give us a fair chance to fix it before you share it. We will answer and tell you what we do about it.