Security

How your data is stored

Scopivo runs on Google Cloud in the United States (region us-central1). We use Firebase App Hosting for the application, Firestore for the database and Cloud Storage for files. Google Cloud encrypts data at rest and in transit by default. All traffic to Scopivo uses HTTPS, enforced with HSTS, and the site sends a strict Content Security Policy that limits which scripts can run in your browser.

Who can access it

All data access happens on our servers. The database and file storage rules deny every direct request from a browser or app, so there is no public path to your records. Every server action checks who you are and what your role allows before it reads or writes anything. Session cookies are httpOnly and secure, which keeps them away from page scripts and off unencrypted connections. Files move through time-limited signed URLs, never public links: for client deliverables, upload links last 15 minutes and download links last 24 hours. We use Sentry for error monitoring, configured so that it does not send personal data by default.

Payments

You connect your own Stripe account. When a client pays an invoice, the charge is created directly on your Stripe account, and the money goes from your client to you. Scopivo takes a 0% platform fee and never holds your funds. Card details are entered on Stripe's pages and never touch Scopivo's servers. Stripe charges its normal processing fees, and payout timing is between you and your own Stripe account.

Contracts and signatures

Before signing, the signer must confirm their email address by entering a one-time 6-digit code that we send to it. Codes are stored hashed, not in plain text. The signature record stores the verified email address, the time of signing and the signer's IP address. Signing is atomic: once a contract has been signed, the same link cannot be used to sign it a second time.

Client links

Your clients do not need an account or a password. Each proposal, contract, invoice and deliverable opens from a private, unguessable link on scopivo.com. You can rotate a link, revoke it, or give it an expiry date. Anyone holding a live link can open that document, so treat a link the way you would treat the document itself. Public forms and booking pages are rate limited.

Your data is yours

You can download a full export of your account data yourself, on any plan, without asking us. You can also delete your account yourself. Deletion is permanent and removes your organization's data. It asks you to type your organization's name first, so it cannot happen by accident.

Your sign-in

Two-step verification with an authenticator app (TOTP) shipped on 2 October 2026 and is available to every account, Free and Pro, from Settings, Security. Once it is on, signing in needs your password or Google account plus the six-digit code from your app, and you get recovery codes for a lost phone. Turning it off, regenerating recovery codes, exporting your data and deleting your account each ask you to sign in again first.

What we do not have yet

Scopivo does not offer single sign-on (SAML or OIDC), and it holds no security certifications such as SOC 2. If your client or your insurer requires those, Scopivo is not the right fit today.

Sub-processors

These companies process data on our behalf:

• Google Cloud and Firebase: hosting, database and file storage (United States)
• Stripe: client payments and subscription billing
• Resend: sending email
• Sentry: error monitoring

Only if you turn the integration on:

• Google Workspace (Calendar, Drive, Sheets, Meet)
• Zoom

Reporting a vulnerability

Email hello@scopivo.com with the steps to reproduce the issue. Please give us a reasonable chance to fix it before you share it publicly. We do not run a paid bug bounty.