Supabase, Inc.
Managed database, authentication, realtime services, and object storage. Primary production region: Frankfurt, Germany. Limited provider support and ancillary processing may occur from other locations under the provider terms.
Security Overview
Security practices designed for modern contract work
Scriboflow protects contract work with secure account access, encryption, activity logging, audit timelines, documented infrastructure, and transparent security practices.
Security overview
Security at a glance
A concise view of the safeguards behind Scriboflow contract work.
Documented provider locations
The primary production database region is Frankfurt, while Vercel and Google Cloud may process in the United States and other global locations under provider terms.
Account Protection
Scriboflow supports multi-factor authentication, email verification, organisation membership, and role-based access.
Contract Activity Logging
Important contract events are recorded through activity logs and audit timelines, including views, signing actions, timestamps, and IP tracking.
Data Protection
Contract data is protected with encryption in transit, provider-supported encryption at rest, and organisation-scoped controls.
Account security
Account security
Access controls for protecting organisation and contract access.
Multi-factor authentication
Multi-factor authentication helps protect organisation access.
Email verification
Email verification helps confirm user access before contract work continues.
Role-based access
Organisation membership and roles limit workspace actions according to assigned permissions.
Data protection
Data protection
Safeguards for documents, metadata, and contract records.
Encryption
Contract data is encrypted in transit and at rest.
Tenant isolation
Organisation checks and row-level security are designed to isolate customer workspaces.
Documented data locations
The primary database region and global infrastructure-provider operations are disclosed in the public provider register.
Contract security
Contract security & audit trails
Visibility into important contract and signing events.
Audit timelines
Contract timelines record important events from creation through signing and completion.
Activity logs
Organisation and contract activity logs help show what happened and when.
IP tracking
IP tracking is recorded for important contract actions.
Evidence-ready records
Timestamps, signer activity, signature events, and full contract history stay visible.
Signing security
Signing security
Signing flows are designed to make signer actions clear.
Secure signing links
Signers access requests through secure links sent for the contract flow.
Signing order
Signing order can guide parties through the expected signature sequence.
Signature consent
Checkbox consent and clear signer actions help document intent.
Identity-based signing
MitID and BankID identity-based signatures are supported through Idura.
Infrastructure
Infrastructure
Scriboflow documents data residency and infrastructure providers without broad compliance claims.
Data Residency
The primary production database region is Frankfurt, Germany. Vercel documents United States and global processing, while Google Cloud may process where it or its subprocessors operate.
Infrastructure Providers
Google Cloud EMEA Limited and Google group processors
Cloud object storage and supporting infrastructure for files and generated contract artefacts. Location depends on the configured resource and provider operations. Google may process where it or its subprocessors maintain facilities, as described in its DPA.
Vercel Inc.
Application hosting, content delivery, server-side request processing, deployment, and operational logs. United States and other global locations used by Vercel and its subprocessors.
Compliance roadmap
Working toward stronger compliance
Scriboflow keeps compliance progress clear as the platform matures.
SOC 2 roadmap
Scriboflow is designed around industry-standard security practices and is actively working toward SOC 2 compliance as the platform grows.
Current focus
Near-term security and compliance work stays documented.
- Security practices documented
- Vendor and infrastructure choices reviewed
- Audit trails and operational controls strengthened
- Formal compliance work continues as Scriboflow matures
Security contact
Security questions?
If you have questions about Scriboflow security, privacy, or data handling, contact us.
Contact us