Your data. Your terms.

Subprocessors

Third parties we share customer data with to operate the service. Listed in plain English with what they do and where they’re hosted.

Sub-processor changes are announced 30 days before they take effect via email to your notification address. Subscribe to subprocessor change notifications by emailing privacy@scarifone.com.

How we handle your AI keys (BYOK)

Every Scarif One install is Bring-Your-Own-Keys. You connect a Gemini / Anthropic / OpenAI key in the setup wizard; we call those providers on your behalf, billed directly to your account at retail. We never mark up an API call.

• Stored encrypted at rest: Every key is envelope-encrypted using NIST-standard AES-256-GCM with random 12-byte IVs and 16-byte auth tags, master key derived from the install’s SCARIF_SECRET_KEY via SHA-256. See lib/secrets.ts in our source.
• Never logged in plaintext: The decrypt-for-use path runs inside a single request scope and is never written to disk, logs, or telemetry. We only ever read the key inside a single AI call lifecycle.
• Visible audit log: Every key read is logged with provider, caller (e.g. ad-generate), timestamp, and outcome. You can see your own log under /security in your dashboard — no plaintext key, just that the key was read.
• Rotation is one click: Generate a new key at the provider, paste it on /integrations, the old key is overwritten on disk. Step-by-step in our BYOK FAQ.
• Leak playbook: If you suspect a key’s been compromised, the provider’s revocation stops billing immediately — see the leak section for our recommended response sequence.
• Sovereign: On a self-host install, your key never leaves your hardware. We literally have no path to read it.

Security posture

• Transport: HSTS-enforced TLS 1.2+ on every connection (max-age 2 years, preload-eligible). Cookies are HttpOnly + Secure (production) + SameSite=Lax + Path=/.
• Encryption at rest: Tenant secrets (AI keys, integration tokens) encrypted with AES-256-GCM. Brand-profile JSON written at file mode 0600.
• Session tokens: HMAC-SHA256-signed, 30-day expiry, rotatable per-tenant secret. A password reset signs out every other session.
• Audit log: Every meaningful action logged per-tenant + visible to admins on /security. AI key access logged separately (see BYOK section above).
• HTTP headers: CSP (with violation reporting at /api/csp-report), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, restrictive Permissions-Policy. Verify any time with curl -I https://scarifone.com.
• Rate limiting: Per-tenant on AI + sync routes — protects you from runaway costs and us from abuse.
• Data isolation: Every tenant has its own data dir and signing secret; cross-tenant access requires session impersonation by a super-admin (logged + transparent to you).
• Backups: Encrypted off-site nightly to Cloudflare R2 (EU jurisdiction). Retention 30 days for hosted plan. Self-host: bring your own S3-compatible storage.

Authentication

• Every plan: Authentication is ours, end to end — no third-party identity provider. Passwords are hashed with Argon2id at OWASP-2024 parameters (memory 65536 KiB, time 3, parallelism 4); sessions are HMAC-signed cookies; brute force is capped per IP and per account.
• Passkeys + 2FA: Sign in with a passkey (Touch ID, Face ID, Windows Hello, a security key) or add authenticator-app 2FA with single-use backup codes; the code is asked on every sign-in. Without either, a browser that hasn’t signed in to your account before needs a one-time code emailed to you. Adding or removing a passkey, or turning 2FA off, asks for your password or code first, and you’re emailed whenever any of it changes.
• Sessions: Every session is listed under Security with the browser and location it started from; sign any of them out, or all of them at once. Sessions end after 30 days, or 7 days unused, and a password change ends them all. Passwords are checked against common patterns and, on hosted plans, against known breaches (only a partial hash ever leaves our servers).
• Recovery: “Forgot your password?” emails a single-use link, valid for an hour, only to an address the account owns. Using it signs out every other session and shows you the passkeys, connected apps and API keys on the account so you can remove any you don’t recognise. Sovereign installs also get single-use recovery codes and work fully offline.
• Critical: Authentication and AI-key handling are separate systems. Your AI keys live encrypted on your tenant volume.

Breach notification SLA

If we discover a personal-data breach affecting your tenant, we will:

• Within 72 hours: Email you + the UK Information Commissioner’s Office (ICO) with: scope of breach, data categories affected, root cause (to the extent known), containment steps already taken, and our remediation plan with timeline.
• On resolution: Publish a postmortem on /incidents with the same scope + a “lessons learned” section. We don’t hide bad days — transparency is how we earn the right to ask for trust.
• For Sovereign customers: Breach disclosure is your responsibility (we have no access to your install). We’ll publish any zero-day affecting the Scarif One codebase as a CVE-style advisory on /incidents with a fix release.

Annual security review

Rather than chase a SOC 2 audit we can’t yet afford, we publish a self-audit against OWASP ASVS + CIS Critical Security Controls. Each control is listed with our current status (pass / partial / not-applicable) and supporting evidence. Honest, controllable, no auditor cost — you can verify every claim against our open source.

Read the latest at /security-review.

Privacy + GDPR

• Right to access / portability: One-click JSON export of every file we hold for your tenant via /security in the dashboard.
• Right to erasure: One-click tenant deletion (with double confirmation) via /security. The data is gone immediately; we log the deletion request to a separate immutable log.
• Data minimisation: We don’t collect what we don’t need. No third-party tracking pixels. No selling data, ever.
• Data residency: The hosted plan runs in the UK (London). The UK holds a European Commission adequacy decision, so EU personal data may be transferred here without additional safeguards. For any other region, take a Sovereign self-host licence and deploy wherever your infrastructure runs — your data never leaves it.
• AI training: We never train models on customer data. Your brand voice and generated content stay yours.
• Self-host: Data never leaves your hardware. We literally have no access.

Reporting a vulnerability

Found a security issue? Email security@scarifone.com with details. We acknowledge within 48h and aim to fix critical issues within 7 days. Responsible-disclosure researchers are credited (with permission) on this page once the fix is shipped.

We don’t currently run a paid bounty programme, but we’ll send a personal thank-you, credit you publicly if you’d like, and prioritise your future feedback.

Contact

• General: hello@scarifone.com
• Privacy / DPA / data-processing agreements: privacy@scarifone.com
• Security: security@scarifone.com
• Status (uptime + incidents): status.scarifone.com

Every claim on this page is verifiable. Read it against our open source (search lib/secrets.ts, proxy.ts, lib/auth.ts), run curl -I https://scarifone.com against our headers, or check the live annual security review.

If anything ever isn’t — or if you spot a gap that should be on this page and isn’t — email me directly: tom@scarifone.com.

— Tom, founder. (Yes, I read every email.)

Want a deeper conversation?

Have specific compliance / data-residency / DPA questions for your buyer? Tom answers them directly.