SOC 2 Type II
Scape holds a SOC 2 Type II attestation. Our security controls are audited by an independent third party annually.
Security
Security isn't a feature at Scape, it's the architecture. Your data is encrypted per user and decrypted only to serve your requests, processed only in the EU, and never used to train AI models. Independently audited every year.
View Trust CenterISO 27001
Scape is certified to ISO 27001:2022, the international standard for information security management. Our certificate is publicly available in the Trust Center.
CASA Tier 2
Independently assessed by TAC Security under CASA, the Cloud Application Security Assessment framework for Google OAuth restricted scopes. The 2026 reassessment is complete, and Scape is revalidated annually.
GDPR & CCPA
Our processing of personal data complies with the GDPR, the CCPA, and other applicable data protection laws. Our Data Processing Agreement and current sub-processor list are publicly available.
EU data residency
Customer data never leaves the EU. Scape is operated from Stockholm, Sweden, and all processing of your content, including hosting, database, AI inference, transcription, and compute, runs in Europe.
Data encryption
All data is encrypted in transit (TLS) and at rest (AES-256-GCM), with encryption applied per user. Your data is decrypted only to serve your requests. Human access to keys is limited to an emergency break-glass account that no single person, including our founders, can unlock alone.
No foundation model training
Your data is never used to train AI models, not by us and not by our AI sub-processors. LLM providers process your data solely to produce your result and return it, under strict contractual retention limits.
Incident response
We maintain a tested incident response process. If a personal data breach affects your data, we notify you without undue delay, and in any case within 72 hours of confirmation.
Bug bounty
Scape runs a public bug bounty program. Independent security researchers test our products and services, and valid findings are rewarded based on severity.
Reports
SOC 2 Type II
Our latest SOC 2 Type II report, covering the design and operating effectiveness of our security controls over time. Available under NDA.
Request reportISO 27001
Our ISO 27001:2022 certificate, issued following an independent audit of our information security management system.
Request reportGDPR & CCPA
Documentation of our GDPR and CCPA compliance, including our Data Processing Agreement and current sub-processor list.
Request reportCASA Tier 2
Details of our annual CASA assessment, performed by TAC Security for Google OAuth restricted scopes. Supporting evidence is available on request.
View detailsFrequent Questions
Answers to what security teams ask us most. For anything else, our security team reads every email.
Contact Us