Is Bitscaled SOC 2 or ISO 27001 certified?

No. We do not claim SOC 2, ISO 27001, PCI DSS, or CMMC certification. We describe the controls we actually operate and will update this page if that changes after a human review.

Where do I report a security issue?

Email security@bitscaled.tech. There is no paid bug bounty. See the vulnerability disclosure policy for scope and expectations.

How is this different from Security services?

This Trust Center explains how Bitscaled protects itself and its clients. /services/security is the catalog of work we sell. Client evidence lives in authenticated Workspace, not here.

Can I see backup or vault evidence without logging in?

No. Customer Workspace evidence is available to authenticated clients. Public pages never include vault identifiers or attestation payloads.

Bitscaled LLC · Tampa, Florida · Trust Center

Security and Trust Center

Review the boundaries that protect your data. Understand our controls, inspect our infrastructure, and bring the right evidence to your next security review.

Request security packet Inspect architecture

Framework readiness & attestations

Readiness is specific to the work in scope. These disclosures distinguish our programs from independent certification.

SOC 2 Type II

Attestation not published

Bitscaled does not claim a SOC 2 attestation. Request a review of the controls and evidence available for your procurement process.

HIPAA Security Rule

Contract-scoped readiness

HIPAA-ready processes and Business Associate Agreements for contracted healthcare work involving PHI. This is not a HIPAA certification.

NIST CSF 2.0

Mapping requires review

Discuss Govern, Identify, Protect, Detect, Respond, and Recover outcomes in a scoped review. No independently assessed framework score is published here.

CMMC Level 2

Certification not claimed

CMMC-oriented client programs are scoped by contract. Level 2 assessment status and applicable evidence must be confirmed for each engagement.

Continuous monitoring, scoped evidence

We monitor platform health. Live framework attestations and automated daily policy results are not published here. The review date above describes policy copy, not a passing compliance check. Check operational status.

Inspect the trust boundaries

Follow a request through the platform, review access and session controls, and inspect the providers involved.

Architecture inspection

Follow the data boundary, inspect the controls, and review the providers. Use arrow keys to move between tabs, then Enter or Space to select.

Inspect the zero-trust boundaries

Requests move from the hosting edge through application authorization to scoped data and purpose-specific storage. Select a stage to inspect its control and review scope.

Boundary 01

Encrypted transport reaches the hosting edge

Public requests use HTTPS with TLS termination at the hosting edge before reaching the application. WAF coverage and active rules depend on the deployment configuration.

Control scope: TLS protects public traffic in transit.
Evidence to review: Confirm active edge policies and deployment-specific routing during review.

Boundary 02

The server establishes identity and permission

Protected Workspace requests resolve the server-side session and enforce company-scoped authorization. A tenant identifier supplied by the browser does not grant access to another company’s records.

Control scope: Session and permission checks apply before protected data is returned.
Evidence to review: Review the authorization rules for the specific workflow and data set in scope.

Boundary 03

Company scope follows the protected request

Server-side company checks scope customer records. Row-level security adds a database policy boundary on configured tables; coverage and privileged service-role access must be assessed for each workflow.

Control scope: Company-scoped authorization; additional RLS where configured.
Evidence to review: RLS is not a universal guarantee across every table or database connection.

Boundary 04

Storage access depends on the asset and workflow

Public website image storage is intentionally public and separate from scoped customer evidence. Access rules for customer documents must be reviewed with the workflow, provider, and bucket configuration.

Control scope: Public assets and protected customer evidence have different access requirements.
Evidence to review: Confirm storage encryption at rest, region, and retention for the contracted scope.

Controls with a defined scope

These descriptions explain application controls. A security review establishes which controls, provider assurances, and contractual commitments apply to your engagement.

Scoped encryption controls

Cryptographic isolation

Application-managed integration and provider credentials use AES-256-GCM encryption. This describes those secret-handling paths; it does not establish unique encryption keys for every tenant or every stored record.

Request key-management, rotation, and provider storage evidence for your scope.

Server-enforced company boundaries

Tenant scoping

Protected customer workflows enforce company-scoped authorization on the server. Selected data sets also use row-level security. Review privileged access and individual data paths when assessing isolation.

Confirm the relevant authorization and RLS coverage for your customer workflows.

Server-side session control

Session lifecycle

The browser holds an opaque HttpOnly session identifier with SameSite=Strict and Secure in production. Session data remains in PostgreSQL, with server-side expiry, revocation, and session identifier rotation.

Review session timeouts and rotation policy for the applicable portal.

Sub-processor and infrastructure governance

Published provider locations do not establish deployment regions or exclusive data residency. Current SOC 2 / ISO reports and encryption at rest require provider evidence; no vendor certification is asserted here.

Infrastructure providers and evidence review requirements
Provider / scope	Hosting location	SOC 2 / ISO status	Encryption in transit / at rest
Hosting and edge delivery	United StatesPublished provider location; deployed region requires review.	Confirm during reviewProvider evidence required	Public HTTPS / TLS at the hosting edge.At rest: confirm during review.
PostgreSQL application data	United StatesPublished provider location; database region requires review.	Confirm during reviewProvider evidence required	Confirm database connection encryption during review.At rest: confirm during review.
Monitoring · optional	United StatesPublished provider location; telemetry region requires review.	Confirm during reviewProvider evidence required	Confirm telemetry transport settings during review.At rest: confirm during review.
Operational secrets management	Confirm during reviewNo hosting region published in the public inventory.	Confirm during reviewProvider evidence required	Confirm secrets-service transport settings during review.At rest: confirm during review.
Email fallback · optional	United StatesPublished provider location; processing region requires review.	Confirm during reviewProvider evidence required	Confirm API and recipient-delivery transport during review.At rest: confirm during review.

Select a provider to open its disclosure. Arrow keys move between provider controls.

Vercel disclosure

Hosts the public website and application. Review deployment regions, edge controls, and the current provider assurance package against the services in your agreement.

Request current SOC 2 / ISO scope, at-rest encryption, and residency evidence.

Listed in the public subprocessor inventory.

SendGrid disclosure

Twilio SendGrid is the optional secondary or fallback email provider when configured; Resend is the primary outbound provider when configured. Email delivery, event webhooks, and inbound processing depend on the enabled integration.

Request current SOC 2 / ISO scope, message retention, and encryption evidence.

Listed as optional Twilio SendGrid in the public subprocessor inventory.

Read the authoritative subprocessor inventory

How we protect Bitscaled

Identity, transport, recovery, and operational controls for the company and platform.

Identity and staff access

Bitscaled portals use cookie-based sessions (HTTP-only, SameSite=strict, Secure in production) plus JWT for API calls. Staff sign in with our custom auth stack. Google Workspace SSO is available for Bitscaled Intranet and Admin when enabled — it is not a customer-facing enterprise SSO product. Multi-factor authentication is required on Bitscaled accounts used to deliver services.

Encryption in transit

Public site and portals terminate TLS at the Vercel edge. Remote access we control over public networks uses TLS. Session cookies carry opaque identifiers; session data stays server-side. We do not publish key-management internals here.

Role-based portals

Admin, Intranet, and Client Workspace are separate portals with RBAC. Client Workspace is organization-scoped. Intranet CRM is Bitscaled’s internal tenant, not a public multi-tenant CRM.

Monitoring and status

We monitor the public website, Client Workspace, VaultTools, and related platform health. Live component status is published on the system status page — this Trust Center does not invent an “all systems secure” banner.

System status

Vulnerability intake

Report product or platform issues to security@bitscaled.tech. We do not run a paid bug bounty. Discord and GitHub alert pipelines are internal operations, not a public intake channel.

Vulnerability disclosure policy

Backup and recovery

We maintain backups and a recovery process for Bitscaled-operated systems. Customer immutable-backup evidence, when contracted, is shown to authenticated Workspace users. We do not publish bucket names, account IDs, or infrastructure identifiers on this site.

Controls for your environment

Managed services follow your agreement. Customer-specific evidence is available through authenticated Client Workspace access.

Managed detection and response

We operate security monitoring and response as part of managed services — with named engineers, not an anonymous 24/7 theater. Scope is defined in the MSA and SOW.

Cybersecurity services

Email security

DMARC, BIMI, and spoof-lab testing (VaultSandbox) so clients can see whether attackers can impersonate their domain. Start with the free tools or a scoped engagement.

Email spoof test

Microsoft 365 hardening

Tenant baseline reviews and ongoing administration when contracted. The public M365 snapshot tool is a starting point, not a substitute for tenant-scoped work.

M365 snapshot

CMMC and HIPAA programs

We run HIPAA-ready operations and CMMC-oriented programs for clients who need them. That is delivery work under contract — not a claim that Bitscaled is CMMC certified or “HIPAA certified.”

Security consulting

Workspace Trust & Governance

Authenticated clients can review Trust & Governance in Client Workspace. Customer Workspace evidence is available to authenticated clients — we do not dump attestation JSON, vault names, or account identifiers on the public site.

Governance module

Immutable backup evidence

When immutable backup is in scope, evidence is presented inside the client portal. Sign in to Workspace to view your company’s controls. Public pages never render raw attestation payloads.

Workspace sign in

Responsible disclosure

Help us investigate safely. Use our security intake for vulnerabilities in Bitscaled-operated services.

Read the scope and testing rules in our vulnerability disclosure policy.
Send the affected URL, reproduction steps, impact, and a safe proof of concept. Do not include customer data, credentials, or secrets.
Coordinate disclosure with our security team while we investigate and remediate.

Email security Disclosure policy security.txt

For security & procurement teams

Request the Enterprise Security Packet

Tell us about your review to request available architecture documentation, control summaries, and vendor due-diligence materials. Our team confirms the scope and any confidentiality requirements before sharing evidence.

Your request opens our contact form with the security packet topic preselected.

Request security packet

Start with a free assessment

Explore VaultTools and the VaultSandbox email lab before a scoped engagement.

Email Spoof Test DNS & SSL Health External Footprint Scan Microsoft 365 Security Snapshot Breach Exposure Check Ransomware Readiness Scorecard BIMI Brand Check

Schedule an Infrastructure & Security Audit

Questions from security reviewers

Is Bitscaled SOC 2 or ISO 27001 certified?: No. We do not claim SOC 2, ISO 27001, PCI DSS, or CMMC certification. We describe the controls we actually operate and will update this page if that changes after a human review.
Where do I report a security issue?: Email security@bitscaled.tech. There is no paid bug bounty. See the vulnerability disclosure policy for scope and expectations.
How is this different from Security services?: This Trust Center explains how Bitscaled protects itself and its clients. /services/security is the catalog of work we sell. Client evidence lives in authenticated Workspace, not here.
Can I see backup or vault evidence without logging in?: No. Customer Workspace evidence is available to authenticated clients. Public pages never include vault identifiers or attestation payloads.

Security services

Delivery SKUs — what we implement for clients (cybersecurity, consulting, hardening programs).

View security services

Workspace Trust & Governance

Client Workspace product module for authenticated customers. Evidence stays in the portal, not on this public page.

Workspace governance

Legal instruments

Contracts and policies: Privacy, Terms, AUP, Cookies, and the DPA.

Legal hub

Data Processing Agreement Privacy Policy Full subprocessor inventory

Provider / scope

Hosting location

SOC 2 / ISO status

Encryption in transit / at rest

Hosting and edge delivery

United StatesPublished provider location; deployed region requires review.