Security
How we handle what you submit.
Certification requires businesses to share sensitive operational detail, so we treat the handling of that information as a first-class part of the program, not an afterthought. This page describes our controls as designed and implemented practice.
- Standards
- v0.9 — Pilot draft
- Status
- Published
- Review cycle
- Reviewed quarterly
ScriptClear does not hold SOC 2 or ISO certification today. Formal third-party attestation work is a planned initiative, not a current claim.
Certification is granted for a defined scope and remains subject to monitoring.
- Standards version
- v0.9 — Pilot draft
- Decision basis
- Published criteria
- Independence
- Commercial roles excluded
- Change control
- Dated effective versions
On this page
What this page covers
- 01Access controlWho can see submitted information.
- 02Role separationCommercial and review functions are kept apart.
- 03EncryptionData in transit and at rest.
- 04Evidence handlingRetention and disposition of review evidence.
- 05Third partiesSubprocessor and partner access discipline.
- 06Incident responseWhat happens if something goes wrong.
Access control
Who can see submitted information.
- Access to application and evidence data is restricted to personnel with a defined operational need
- Reviewer access is scoped to the applications assigned to them, not the full evidence archive
- Administrative access is logged and periodically reviewed
- Role assignments are revoked when a person's responsibilities change or their engagement ends
Role separation
Commercial and review functions are kept apart.
The structural separation described in our governance model extends to system access: sales and account management roles are not granted the same access as reviewers, and reviewers do not have standing access to commercial or billing records.
Encryption
Data in transit and at rest.
Submitted content, uploaded evidence and stored assessment records are encrypted in transit using industry-standard transport security and encrypted at rest within our infrastructure providers.
- Connections to the application and review portal are encrypted in transit
- Stored evidence files and decision records are encrypted at rest
- Encryption key management is handled through our infrastructure provider's managed key services
Evidence handling
Retention and disposition of review evidence.
- 1
Collection
Evidence is captured with a timestamp and tied to a specific application and standards version.
- 2
Active use
Evidence remains accessible to the assigned reviewer and relevant governance roles for the duration of review, appeal or monitoring.
- 3
Retention
Decision records and supporting evidence are retained for a defined period to support appeals, renewals and audit trail integrity.
- 4
Disposition
Evidence outside the retention window is scheduled for deletion in line with our data retention practice.
Third parties
Subprocessor and partner access discipline.
Where infrastructure or workflow vendors process submitted data on our behalf, they are engaged under written terms that limit use of that data to providing the contracted service.
- Subprocessors are evaluated before onboarding and reviewed periodically
- Partner organizations receiving certification status information are granted permissioned, scope-limited access — not raw evidence access
- Access granted to any partner can be revoked without affecting a certified business's underlying record
Incident response
What happens if something goes wrong.
We maintain an internal process for triaging and escalating suspected security incidents, including notification steps where required by applicable law or contract.
- 1
Report
A suspected issue is reported through the disclosure contact below.
- 2
Triage
The report is assessed for scope, severity and affected data.
- 3
Containment and remediation
Access is restricted or systems are patched as needed to stop ongoing exposure.
- 4
Notification
Affected parties are notified consistent with applicable legal and contractual obligations.
FAQ
Questions we hear often
- Is ScriptClear SOC 2 certified?
- No. ScriptClear does not currently hold SOC 2, ISO 27001 or any other formal security certification. Pursuing formal attestation is a planned initiative.
- How do I report a security concern?
- Email security@scriptclear.co. See /contact for what to include so we can triage quickly.
- Do partners see my raw evidence files?
- No. Partners receive permissioned, scope-limited status information by arrangement. They do not receive standing access to underlying evidence.
Not sure where your organization stands? Start with a preliminary eligibility check.
Compliance should be clear, not complicated
Have a security question or a disclosure to make?
Reach the security contact directly rather than filing a general inquiry — it routes faster.
Know where you stand. Fix what matters. Stay ready.