Encrypted everywhere
TLS 1.2+ on every connection, including between our own services. AES-256 on the database, backups, file storage and cache.
Trust & Security
Security Your IT Team Will Sign Off On
How Scalign protects your meetings, deals and buyer data. The details are all here, so the security review goes quicker.
- GDPR + DPA
- A data processing agreement available to every customer
- AES-256
- Encrypted at rest, TLS 1.2+ in transit
- Monthly
- External penetration tests by Heist Security
- 72 hours
- Maximum time to tell you about a data breach
- Zero training
- Your data never trains public or shared AI models
Security controls
Locked Down by Default
What protects your data every day, written for the person filling in your security questionnaire.
Transcripts sealed per workspace
Every transcript gets its own layer of AES-256-GCM encryption, tied to your workspace. It can’t be decrypted inside anyone else’s.
Roles and sharing you control
Owner, admin and member roles checked on every request, plus visibility settings on each recording. SSO/SAML on the Enterprise plan.
Least-privilege access
Only staff who run production can reach customer data. MFA on every internal account, and access is revoked the day someone leaves.
Tested every month
Heist Security runs external penetration tests monthly against OWASP ASVS 5.0 and the OWASP Top 10, including cross-workspace access.
Summary on requestReviewed before it ships
Every change goes through code review and automated checks. Dependabot and CodeQL scan for vulnerabilities around the clock.
Backed up daily
Encrypted daily backups kept for 35 days. Our recovery plan targets at most 24 hours of lost data and 8 hours to get back up.
A plan for the bad day
A documented incident response plan with a named lead. If a breach touches your personal data, you hear from us within 72 hours.
How we use your data
Your Data Works for You Only
Scalign uses your meetings to run your workspace. That’s the whole list.
Never used to train AI
We never sell your data or use it to train public or shared models. Our AI providers’ terms rule out training on it too.
You own it
Your meetings, notes and deal data stay yours. We process them only to deliver Scalign, on your instructions under the DPA.
No voiceprints
Speakers are told apart within a single recording only. We never create or store voiceprints or match voices across meetings.
Recording out in the open
The assistant joins as a visible participant, so everyone knows. Your team stays in charge of getting consent to record.
Deleted means deleted
Deleting in Scalign takes data out of use right away. Here’s when it’s erased for good.
- After 24 hoursDeleted recordings are permanently erased
- 14 daysDeleted workspaces are permanently erased
- 30 daysDeletion requests completed
- 42 daysDeleted data ages out of encrypted backups
Sub-processors
Who Touches Your Data
The services that help run Scalign. Every one is under a data processing agreement.
| Service | What it does for Scalign |
|---|---|
| Neon | Hosts our main database |
| Vercel | Hosts the app, stores encrypted files, and runs website analytics |
| Recall | Records and transcribes meetings, and stores the recordings |
| AssemblyAI | Transcribes meetings |
| OpenAI | Powers AI features |
| Google Cloud | Stores encrypted database backups |
| WorkOS | Signs you in with magic links and SSO |
| Stripe | Handles payments and invoices |
Only if you connect them:HubSpotSalesforcePipedriveAttioGoogleMicrosoftSlackFathomFirefliesModjo
Your main database runs in AWS Frankfurt. For where each service keeps data and its DPA, see the full list.
Documents
Everything for Your Review
Data Processing AgreementGDPR Art. 28 terms between you and ScalignSecurity MeasuresDPA Annex II, every control in detailSub-processorsThe full list, with locations and DPAsData ProcessingWhat data flows through ScalignPrivacy PolicyHow we handle personal dataPen test summaryLatest report summary, on request
FAQ
Security Questions
The ones IT asks first.
Is Scalign GDPR compliant?
Yes. Scalign is GDPR compliant and offers a data processing agreement (DPA). Customer data is encrypted in transit and at rest with AES-256, and protected by role-based access controls. The full list of sub-processors is on our Trust & Security page.
Does Scalign train AI models on my data?
No. Scalign never sells your data or uses it to train public or shared AI models. Your data is used only to run your own workspace, and it stays yours.
Does Scalign join my meetings as a bot?
For virtual meetings, the Scalign assistant can join as a participant, so everyone can see the meeting is being recorded. If you'd rather not have a bot in the call, the desktop recorder (on the Pro plan) captures the meeting from your computer instead.
What if a prospect doesn't want to be recorded?
Skip the recording for that meeting. Scalign still works well as long as most of your meetings are recorded, since each account's playbook builds up over many conversations. Your team is responsible for getting consent to record, and Scalign doesn't manage consent on your behalf.
More questions? See all FAQs
Found a vulnerability?
We welcome reports from researchers, customers and partners. Email security@scalign.ai and we’ll investigate and get back to you promptly.
Pass Your Security Review
Start free, or book a demo and bring your IT questions.