Security

This page describes how ScreenTrace Technologies runs hosted Scribble Flow. It is not a SOC 2, ISO, or other certification, and it is not a guarantee.

In transit and at rest

Public traffic is served over TLS. Workspace files go to S3-compatible object storage. The database and Redis sit on the private compose network behind the TLS terminator.

Access

Operator access is limited to people who run the service. Company admins manage seats, SSO, and policy; they do not read employee inboxes through the product. Platform staff tools are separate from customer desks.

Backups and audit

We take backups with retention as configured on the host. Admin actions (login, invite, export, policy) are written to an audit log. Scribble bodies are not sent to optional error reporting by design.

Self-host

Customers who need data on their own machines can run the published Compose stack instead of the SaaS.

Report a problem

Write to support@scribbleflow.app. Please do not attach customer workspace content unless we ask. Related: Privacy, DPA.