Your agreements, kept safe
Signed baselines and approvals are records you may need to rely on later. Here is how we store them, who can see them, and what you can take with you.
Where your data lives
ScopeAgreed runs on cloud infrastructure in the United Kingdom. We do not move customer data outside the UK and EU.
Hosting
Application and database are hosted in London on ISO 27001 certified data centres. Backups replicate to Dublin.
Backups
Encrypted backups run every hour and are kept for 30 days. We test a full restore every quarter.
Uptime
We target 99.9% monthly availability. Planned maintenance is announced at least 48 hours ahead and runs outside UK working hours.
Sub-processors
Payments, email delivery and error monitoring use named third parties under GDPR terms. The current list is in our privacy policy.
Who can see what
Access is scoped to your studio. Clients see only what you send them, and only for the project it belongs to.
Your team
Owners, admins and members. Members can log changes; only owners and admins can send baselines, change plans or remove people.
Your clients
Approval links are unique, single-purpose and expire 30 days after a decision. Clients never see other projects or your internal notes.
Two-factor authentication
Available on every plan and required for all owners. Agency plans can enforce it for the whole studio.
Our staff
Support staff can only access your account with your written permission, and every access is logged and visible to you in Settings.
Approvals that hold up
A signed approval is only useful if you can show who agreed to what, and when.
Audit trail
Every baseline, change request and decision is stored with the name, email, IP address and timestamp of the person who acted.
Immutable once signed
Signed baselines and approved changes cannot be edited. Corrections are logged as new changes against the record.
Export and leave
Download all your projects, approvals and audit logs as PDF and CSV from Settings. If you close your account, data is deleted within 30 days.
Retention
While your account is active we keep everything. Closed projects stay read-only and exportable for as long as you stay a customer.
Found something?
We take reports from security researchers and customers seriously, and reply within two working days.
Responsible disclosure
Email info@scopeagreed.com with the subject line "Security". Please give us time to fix an issue before publishing it.
Incident notification
If an incident affects your data we tell you within 72 hours, with what happened, what we did and what you should do.
Questions before you start?
We are happy to walk through our setup, or send a DPA and sub-processor list for your records.
Contact us