Legal

Security

How Scail Capital LLC protects the data in SCAIL, in plain terms, and how to tell us about a problem. This page describes what we do. It is not a promise that nothing can go wrong.

Draft — pending counsel review

Effective October 29, 2026 · Scail Capital LLC

1What we do

  • Separation between businesses. Every operator’s workspace is kept apart from every other operator’s, and database access rules are applied to every table.
  • Sensitive fields are encrypted. Full Social Security numbers, dates of birth and stored credentials are encrypted before they are saved, and shown only as the last four digits where a number has to appear. Access to those fields is written to an audit log.
  • Passwords are never shown or emailed. We send reset links, not passwords. Notification emails link to the app and carry no account details.
  • Encrypted in transit. Traffic to scailapp.com and the app uses HTTPS.
  • Payment cards stay with the payment processor. Card numbers are entered with Stripe and never reach our servers.
  • Secrets live in environment variables, not in code or in the repository.
  • Vendors. The companies that handle data for us are listed on the Subprocessors page.

We do not claim any third-party security certification or audit report on this page. If a customer needs a security questionnaire answered, email us and we will answer it in writing.

2Reporting a security issue

If you think you have found a vulnerability in scailapp.com or in SCAIL, email legal@scailapp.com with the subject “Security”. Tell us what you found, the page or request involved, and the steps to reproduce it. Our machine-readable contact is at /.well-known/security.txt.

  • Please do not access, change or keep other people’s data, and do not disrupt the service.
  • Give us a reasonable chance to fix the problem before you share it publicly.
  • We will acknowledge a report in writing and tell you when it is fixed. We do not run a paid bounty program.
  • Report in good faith and within these limits, and we will not pursue action against you for the research.

3If something happens to your data

If we learn that personal information we hold has been accessed without authorization, we will investigate, contain it, and notify the affected operators and any regulator as the law requires, with what we know and what to do next. See the Privacy Policy for how we handle information and the Data Processing Addendum for the terms with operators.