Security at Scopeleaf

• A+ is each test’s top grade. Two tests mark down one setting: our pages may run inline scripts, which lets them be served ready-made.
• Anyone can run the tests again, and the result may differ from the day we read it. We run the Mozilla Observatory test again after each change to our headers.
• OWASP ASVS Level 1 has 70 requirements: 49 are met by our code, 11 by our sign-in provider, 3 in part, and 7 are not relevant to us.
• GitHub’s code scanning (CodeQL) last checked the code on 18 October 2026 and found nothing in the code that runs Scopeleaf. We start it by hand.
• We send the technical and organisational measures we take (GDPR Article 32) on request, for your processing agreement.

• People join a document through its invite link. If the link leaks, the host replaces it and the old one stops working.
• The host holds the document's controls, the operator answers the AI's interview, and guests edit and watch. A guest sees only the documents they were invited to.
• What the AI or an invited AI agent proposes arrives as a card, and changes nothing until someone approves it. The host can revoke an agent at any time.
• People in a document see each other by name, never by e-mail address.
• Closing a document ends access for guests and the AI and keeps the work. Deleting it removes it for everyone.
• A ready ticket downloads as HTML, Markdown or Word.
• A shared prototype opens with a link and a generated password. After 10 wrong tries, the link locks for 15 minutes.
• Product analytics start only after you accept them, and never carry document text.
• Deleting your account ends access at once, and what it holds is removed as the privacy policy describes.

• Every connection uses HTTPS with TLS 1.2 or 1.3. A plain http address is sent to https, and browsers are told to use nothing else, for every subdomain. Convex encrypts the stored database and files with AES-256.
• A document opens to its host and the people who joined through its invite link. Our server checks this before it answers each request.
• Every page carries a Content-Security-Policy that names the services the app may load from and talk to, refuses framing by other sites, and keeps plugins out.
• Jira tokens are sealed again by us, with AES-256-GCM, on top of the database's own encryption.
• A prototype the AI builds runs on a separate address, in a sandbox, with no access to your sign-in or to the app.
• Sign-in is protected against bots. Joining, AI requests, invitations, comments and imports have limits per hour or per day.
• We build and test on separate systems with test accounts. Your documents live only in the production database.
• Passwords and API keys live in a secrets manager, never in the code. Test evidence is scanned for them before anyone else sees it.
• A change to the code goes through a pull request, a review and automated tests before it goes live.

• We do not train models on what you write in Scopeleaf.
• The AI runs on models made by OpenAI and DeepSeek, reached through OpenRouter.
• Each AI request asks the model provider to keep nothing. The provider is chosen per request and can be outside the EU.
• Text the AI writes keeps an AI mark in the document, and shows as not reviewed until a person approves it.
• An HTML or plain Markdown download carries no AI mark: if you publish AI-written text, say so where the law asks you to.
• GrillMe, the interviewer, is the AI, and the product says so.
• When the AI is not available, Scopeleaf says so, and your document keeps working.

• Your documents and files are stored by Convex in Ireland. Some providers run partly in the United States, and the table below names each one.
• A document is kept until its host deletes it, from its More menu, or deletes their account. Nothing expires on its own.
• Document text is kept out of our logs, error reports and analytics. Error reports drop request bodies, and invite links are removed from the addresses they record.
• Scopeleaf is provided by REL8, a company in Poland, so the GDPR, the EU AI Act and Polish law apply to it. For what you put into Scopeleaf, you decide and we process it for you: the processing agreement (Article 28) is part of the terms.
• We keep a record of every processing activity (Article 30), a register of what each part of Scopeleaf stores and when it is deleted, and a procedure for a security incident or a personal-data breach (Articles 33 and 34). We review them and this page every October. They are our own records, not an outside audit: ask us if your review needs them.
• You can ask for a copy of your data, its correction or its deletion.

Each provider gets only what its job needs. What each one receives, and the safeguard for each transfer, is in the privacy policy.

• Use only your own accounts, or accounts whose owners agreed.
• Look at no more data than you need to show the problem, and delete what you saw.
• No denial of service, no high-volume automated scanning, no phishing or other tricks aimed at people.
• Give us a fair chance to fix it before you tell anyone else.

We contain the problem first: we change the affected keys, end sign-in sessions or switch the feature off. Then we work out what was touched. If personal data was involved and it may put people at risk, we notify the Polish data protection authority (UODO) within 72 hours. If it touched what you keep in Scopeleaf, we tell you without undue delay, with what you need to inform your own people.

• AI processing inside the EU, as an option
• Single sign-on for organisations

We are also answering the Cloud Security Alliance’s security questionnaire, to publish it in its public STAR Registry and renew it every year.