Scorift Security & GDPR Compliance

Scorift runs on Google Cloud Platform across multiple zones, with managed Postgres, automated failover, and daily encrypted backups. Regional deployments keep customer data in the region the customer selects.

• Principle of Least Privilege: Access to internal systems, backend databases, and customer metadata is strictly limited to authorized Scorift engineering and support personnel.
• Multi-Factor Authentication (MFA): Enforced across all administrative dashboards, source code repositories, and operational cloud environments.
• Role-Based Access Control (RBAC): Ensures proper segregation of duties and audit logging for every system interaction.

• Data in Transit: All transactional metadata, API requests, and user communications transmitted to or from Scorift are encrypted utilizing industry-standard Transport Layer Security (TLS 1.3) protocols.
• Data at Rest: All stored customer databases, model artefacts, and backup volumes are encrypted using Advanced Encryption Standard (AES-256).

• Continuous Monitoring: Automated intrusion detection systems and threat intelligence tools monitor our API endpoints and network architecture 24/7.
• Penetration Testing: Routine security audits and independent third-party penetration testing are conducted to proactively identify and patch potential attack vectors.

Depending on the processing context within the Scorift platform:

• Scorift as a Data Processor: When corporate clients use the Scorift software to analyze end-user behavioral signals and transaction logs for fraud prevention, Scorift acts strictly as a Data Processor, handling personal data only on documented instructions from the client (the Data Controller).
• Scorift as a Data Controller: When managing direct business accounts, enterprise billing records, and website communications, Scorift acts as a Data Controller.

Scorift ensures that any personal data processed directly by our systems adheres strictly to core data protection principles: processed lawfully, fairly, and transparently, and collected solely for explicit, legitimate fraud-mitigation purposes.

Clients utilizing the Scorift software agree and warrant that they:

• Provide clear and transparent privacy notices to their own end-users regarding how transaction data is monitored and screened for fraud.
• Process data lawfully and maintain an appropriate legal basis for transferring transactional metadata to Scorift.
• Promptly handle Data Subject Access Requests (DSARs) or requests for data rectification / deletion submitted by their end-users.

To satisfy Article 28 of the GDPR, Scorift includes a Data Processing Agreement (DPA) into our agreements, detailing data security commitments, confidentiality clauses for authorized personnel, sub-processor disclosures, and provisions for assisting data controllers with compliance obligations.

If you have any questions regarding our security infrastructure, compliance certifications, or GDPR alignment, please contact our data protection team at privacy@scorift.com.