Encrypted
TLS 1.2+ in transit and AES-256 at rest.
Trust & security
Last updated: July 1, 2026
Isolated
Customer data remains separated by customer.
Permissioned
Access is limited to the people operating the service.
Not shared
Customer data never trains models for other customers.
Overview
ScoringFactory scores founders, companies, and candidates using evidence pulled from the public and permissioned record. The data is sensitive by nature. This page describes how we protect it today and what is still in progress.
Infrastructure
ScoringFactory is hosted on Vercel, with data stored in the United States. All traffic between your browser and our servers is encrypted in transit using TLS 1.2 or later. Data at rest is encrypted using AES-256.
Access control
- Customer data is accessible only to employees who need it to operate or support the product.
- Internal access uses single sign-on with multi-factor authentication enforced.
- Production database access is logged and limited to the engineering team.
Data handling
We ingest only the data relevant to the scoring task a customer asks us to perform. That data comes from the public record and information the customer has the right to share. We do not sell personal data, and we do not use customer data to train models for other customers.
Subprocessors
We rely on a small number of subprocessors for hosting, data enrichment, and infrastructure. Request the current list at trust@scoringfactory.ai.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting | United States |
| Database provider | Data storage | United States |
| Data enrichment providers | Public-record enrichment | United States |
Compliance
We are early-stage and do not yet hold SOC 2 or ISO 27001 certification. We follow SOC 2-aligned practices and plan to pursue formal certification as we scale enterprise customers.
Incident response
If we discover a security incident affecting customer data, we will notify affected customers without undue delay and no later than 72 hours after confirming the incident. We will explain what happened, what we are doing, and any action the customer should take.
Retention and deletion
We retain data for as long as needed to provide the service or as required by contract. We delete it on request or contract termination, subject to a backup retention window that is typically 30 days.
Report a concern
Send security questions or vulnerability reports to security@scoringfactory.ai. We will acknowledge reports within two business days.