Security & privacy
Claim data is protected.
Claim files contain sensitive property, insurance, and contractor information. ScopeRecord uses access controls, encryption, and restricted administrative access to protect submitted files. This page reflects current practices — not a third-party certification.
0
Access is restricted by default
claims readable without a sign-in
Row-level security is enforced by the database on every single request, not by application code that could be bypassed. Anonymous visitors cannot read back a single claim, file, or contact record. Reading claim data or downloading a file requires an authenticated admin sign-in, and every access is logged.
30d
Deletion on request
outer bound on deletion from live systems
Ask and we export or delete anything you've sent — the claim record and every file attached to it. Deletions are honoured promptly and removed from live systems within 30 days at the outside.
The rest of the posture
6 controls
- Encryption in transit
- All uploads and site traffic use TLS. No claim document is ever sent over an unencrypted connection.
- Encryption at rest
- Documents and claim records are stored with AES-256 encryption on managed cloud infrastructure (Supabase).
- Isolated by design
- Every claim is protected by row-level security policies enforced by the database on every single request — not just in application code.
- No model training on your data
- Your claim documents are not used to train any model. They're used only to review and process your specific claim.
- Founder-operated
- ScopeRecord is currently a small, founder-operated team, not a large support organization.
- Vendors
- Claim data is hosted on Supabase (database and storage) and Vercel (web hosting) — both SOC 2–audited infrastructure providers. ScopeRecord itself does not hold a SOC 2 certification.
What we collect
- Claim documents you submit — carrier estimates, roof reports, photos, policy pages.
- Contact info — your name, company, email, and phone number.
- Basic product usage, used only to operate and improve the intake process.
What we don’t do
- Sell or rent your data. Ever.
- Train models on your claim files.
- Share your claim details with other contractors or carriers.
- Claim certifications we don’t hold.
Questions or concerns
Found something concerning? Tell us directly.
For the plain-English version of what we do with your data, read the privacy policy. For what we do and don’t do with your claim, read the terms.
Send one and see.
Your first claim is free, and everything on this page applies to it from the moment you upload.