Trust Center

How we protect your data

ScaleQuality reads your repositories to measure code maturity, and your engineering metadata (commits, pull requests, boards) to measure delivery. This page explains what we do with your source code, what we keep, what we never collect, and where our own limits are.

01Principles

Anti-surveillance by design

Metrics are team-aggregated, never per-author. We don't collect AI prompt content, nor track keystrokes. No engineer is exposed.

Multi-tenant isolation

Every query carries a mandatory orgId. No silent cross-tenant fallback — verified by automated checks in CI.

Data residency

All data lives in us-east-1 (AWS) today. Regional deployment (EU, Brazil) is scoped as part of an Enterprise engagement, not a switch we flip.

Least privilege

OAuth tokens for your integrations (GitHub, Jira, Azure) use the smallest scope required. No keys are shared across services.

02Compliance and frameworks

We are pre-certification and we say so plainly. What is below is what we can evidence today, plus what we commit to on an Enterprise engagement. DPA requests, sub-processor lists and security questionnaires are answered within 5 business days.

SOC 2 Type II

Not certified yet. We operate against the Trust Services Criteria (access control, change management, encryption, logging) and we start the formal audit as a contracted commitment when an Enterprise customer requires the report.

Pre-certification

LGPD (Brazil)

We act as Data Processor (Art. 5, LGPD). DPA available upon request.

Compliant

GDPR (EU)

SCC addendum available for EU customers. Data subject requests are handled by the security contact below.

Compliant

We run our own product against ourselves

Every ScaleQuality service is measured by ScaleQuality on every change: static analysis, secret scanning, known-vulnerable dependencies, infrastructure misconfiguration and container CVEs, with a build gate that fails below the line. That is not a substitute for an independent penetration test, and we commission one as part of an Enterprise engagement. It is, however, evidence you can ask us to show, dated, for any commit.

03Evidence for your audits

The section above is about our posture. This one is about yours: with ScaleQuality running in your environment, the evidence that IT governance audits ask for comes out of the platform ready, instead of being assembled by hand the week the auditor arrives.

Continuous code security analysis, findings with CWE

Secure development and code vulnerability analysis (ISO 27001 Annex A, SOC 2, NIST SSDF)

Live inventory of vulnerable components, including container image CVEs

Third-party and software supply-chain vulnerability management (ISO 27001, EU CRA, CMN Res. 4.893)

CycloneDX SBOM per repository, exportable on every analysis

The supply-chain artifact asked for by name (FDA 524B, EO 14028, EU CRA documentation)

CI quality gate that breaks the build below your cutoff

Change control: proof no change ships past the policy (SOC 2, ISO 27001)

Agent fixes with re-scan proof and mandatory human-reviewed PRs

Documented vulnerability treatment with independent verification of the fix

AI usage inventory and measured cost, with audit export (JSON, provenance-tagged)

Corporate AI inventory and monitoring (NIST AI RMF, ISO/IEC 42001, EU AI Act)

Content compliance reviews anchored to your registered rules, exported as PDF

Auditable regulatory content review (finance, health, advertising)

Platform audit trail with export, role-based access, SSO/SAML on Enterprise

Traceability and identity management (ISO 27001 logging, SOC 2, LGPD technical measures)

Regime controls evaluated against measured evidence, with an owner and a status per control

Ten packs versioned in the repository: CMN 4.893, CFM 2.454, ISO 27001, SOC 2, ISO 42001, LGPD, ANVISA RDC 657, NIST SSDF, EU AI Act and EU CRA

Exception with an owner, a deadline and a justification when risk is knowingly accepted

Formal risk acceptance, with a maximum validity and reopening on expiry. An exception never reads as compliant

Who opened and who approved every merged change, PR by PR, with the commit

Segregation of duties in change (SOC 2 CC8.1, ISO 27001 A.8.32, CMN 4.893)

Period dossier, up to 24 months, with SHA-256 per file and a signed manifest

Integrity verifiable by a third party with the public key, without taking our word for it

Compliance events delivered over a signed webhook, and the same reading through the API

Your GRC tool consumes the evidence straight from the source, with no manual collection

ScaleQuality produces the technical evidence that supports these processes. Certification and regulatory sign-off remain with auditors and the competent authorities, which is exactly why evidence you can hand over matters.

04What happens to your source code

This is the question every security review asks first, so it gets its own section and the plainest words we have.

A diagnosis clones the repository to ephemeral disk inside our own container, runs the scanners there, keeps the RESULT (scores, risks, file paths and line numbers) and deletes the clone when the run ends. We keep no copy of your code.

The scanners are open source and run entirely on our infrastructure: Semgrep for static analysis, Gitleaks for secrets, OSV for known-vulnerable dependencies, Trivy for infrastructure and container misconfiguration, jscpd for duplication. Your code is never sent to any of their vendors.

The model that helps write the verdict receives measurements and file paths, never source content. It is told how many modules have tests and which paths do not; it never sees a line of your code.

Our AI inference runs on Amazon Bedrock inside OUR AWS account, authenticated by the container's task role. Your data is not sent to a third-party model API, and it is not used to train anything.

Agents are the one exception, and it is deliberate: to FIX code an agent sends the relevant excerpt to that same in-account inference. The agent opens a pull request and never merges it. Human review is structural, not a setting.

An agent can only write to a repository through the provider connection your organisation authorised, and only on GitHub and Azure DevOps. GitLab and Bitbucket are read-only for us, by OAuth scope.

05How we handle your data

Encryption in transit (TLS 1.2+) and at rest (AES-256 on RDS and S3).

Daily RDS backups with 30-day retention and point-in-time recovery.

Per-organization audit logs, CSV-exportable by administrators.

Default retention 24 months; customers can negotiate shorter terms.

Right to be forgotten: full deletion within 30 days of formal request.

We never train AI models on your data. Period.

06Sub-processors

Providers that process data on our behalf. Changes to this list are notified to Enterprise customers 30 days in advance.

Provider	Purpose	Region
Amazon Web Services	Hosting, database and storage	us-east-1
Amazon Bedrock (Anthropic models)	AI inference for the verdict narrative and for the agents that write code	us-east-1
Stripe	Payment processing	Global
Amazon SES	Transactional email delivery	us-east-1
Cloudflare	CDN and DDoS protection	Global

07AI telemetry connectors

When an organization connects a provider to bring in real usage and billing telemetry, the key is encrypted at rest with AES-256-GCM. No endpoint returns the secret in any response. These are the exact scopes each connector uses.

Anthropic (Claude / Claude Code)

Reads org-wide input/output tokens + cost via the Admin Usage Report API.

Scope read

Admin key (read-only, org-wide)

Cursor

Reads team members, 30-day spend and per-event tokens via the Cursor Team Admin API.

Scope read

Team admin API key

Key encrypted at rest AES-256-GCM with a random IV per value. Auth tag validates integrity. Never appears in any API response or log. Supports rotation, disconnect and test-connection without ever exposing the secret.

Security team

Found a vulnerability? Questions about our threat model? Need a DPA, SCCs, or a filled-out security questionnaire? Reach out — we reply within 1 business day.

security@scalequality.io

Last reviewed: September 3, 2026