ISO 27001 Aligned
Information security management built into every layer
ScopeShift is built to ISO 27001 information security management standards. Our security controls, risk assessment processes, and incident response procedures are aligned with the ISO 27001 framework, covering information security policies, asset management, access control, cryptography, physical security, operations security, communications security, and supplier relationships.
Note: ScopeShift is aligned to ISO 27001 standards. Formal third-party certification is part of our ongoing roadmap.
Data Protection
Encryption, privacy, and consent management
Encryption
- ✓At rest: AES-256-GCM encryption for all sensitive fields including emails, phone numbers, and GPS coordinates
- ✓In transit: TLS 1.3 enforced for all data transmission
- ✓Passwords: Hashed with bcrypt, never stored in plain text
- ✓Key management: Encryption keys rotated on a defined schedule, separated from data storage
GDPR Compliance
- ✓Consent management: Granular, revocable consent for data processing and notifications
- ✓Right to erasure: Self-service data deletion with automated PII scrubbing
- ✓Data portability: Export your data in JSON or CSV format at any time
- ✓Data minimisation: Only essential data collected, with defined retention periods
Access Control
Authentication, authorisation, and session management
Authentication
- Multi-factor authentication (TOTP)
- Biometric authentication on mobile
- Backup recovery codes
- Account lockout after failed attempts
Role-Based Access (RBAC)
- 7 defined permission levels
- Multi-tenant organisation isolation
- Per-project access scoping
- Quarterly access reviews
Session Management
- JWT with short-lived access tokens
- Secure refresh token rotation
- Idle timeout with user warning
- Force logout on password change
Infrastructure Security
Cloud hosting, backups, and disaster recovery
Cloud Hosting
- ✓EU-based data centres for UK GDPR compliance
- ✓Network segmentation and firewall rules
- ✓DDoS protection and rate limiting
- ✓Automated security patching
Backups & Disaster Recovery
- ✓Daily automated backups at 02:00 UTC
- ✓30-day backup retention
- ✓Recovery Time Objective (RTO): 4 hours
- ✓Recovery Point Objective (RPO): 1 hour
Compliance
Regulatory and industry compliance
Data Protection Regulations
- UK GDPR — Full compliance with data subject rights, lawful basis for processing, and cross-border transfer safeguards
- Data Protection Act 2018 — UK-specific data protection requirements including ICO registration
Industry Requirements
- CDM Regulations 2015 — 7-year construction record retention
- HMRC Requirements — 7-year financial record retention
- Complete audit trail — Every action tracked with user, timestamp, IP, and change details
Incident Response
Monitoring, detection, and response procedures
Monitoring
24/7 automated security monitoring with anomaly detection, rate-limit enforcement, and real-time alerting for suspicious activity.
Response Procedures
Defined incident classification (P1–P4), escalation paths, and response procedures with designated Incident Response Team members.
Breach Notification
GDPR-compliant 72-hour breach notification to the ICO and affected data subjects. Post-incident review with root cause analysis and preventive measures.
Vulnerability Reporting
How to report security issues
If you discover a security vulnerability in ScopeShift, we encourage you to report it responsibly. Please email us with details of the vulnerability, steps to reproduce, and any supporting evidence.
Report vulnerabilities to:
We aim to acknowledge reports within 48 hours and will keep you informed of our progress. We will not take legal action against researchers who report vulnerabilities in good faith.