Last updated: July 1, 2026
ScoringFactory scores people — founders under diligence and candidates in a hiring pipeline — using evidence pulled from the public and permissioned record. That means the data we handle is sensitive by nature, and security isn't a feature we bolt on, it's the product working at all. This page describes how we protect it today and what's still in progress.
ScoringFactory is hosted on Vercel, with data stored in the United States. All traffic between your browser and our servers is encrypted in transit (TLS 1.2+). Data at rest is encrypted using AES-256.
We only ingest data relevant to the scoring task a customer has asked us to perform, sourced from the public record and any data the customer has the right to share with us. We do not sell personal data, and we do not use customer data to train models for other customers.
We rely on a small number of vetted subprocessors for hosting, data enrichment, and infrastructure. A current list is available on request at trust@scoringfactory.ai.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting | United States |
| Database provider | Data storage | United States |
| Data enrichment providers | Public-record data enrichment | United States |
We are early-stage and do not yet hold SOC 2 or ISO 27001 certification. We follow SOC 2-aligned practices and plan to pursue formal certification as we scale enterprise customers.
If we discover a security incident affecting customer data, we will notify affected customers without undue delay and no later than 72 hours after confirming the incident, with what we know, what we're doing about it, and what you should do.
We retain data for as long as needed to provide the service or as required by contract, and delete it on request or on contract termination, subject to our backup retention window (typically 30 days).
Found a vulnerability or have a security question? Email security@scoringfactory.ai. We take reports seriously and will acknowledge within 2 business days.