Data handling
The short version: prompts and completions pass through in memory and are never written to any store, log, or trace. We keep the minimum needed to bill you — account email, payment references, and per-request accounting metadata — and we pseudonymize the usage telemetry. The full posture, including when we would ever disclose anything, is in the Privacy Policy and the engineering boundary it's built from.
Infrastructure
- Hosted on Vercel; Postgres on Neon; Redis on Upstash; DNS and object storage on Cloudflare. US-hosted.
- All infrastructure is declared as code (Terraform) — no hand-configured production.
- Secrets live in a managed secret store, never in source. API keys and session tokens are stored hashed.
- The inference upstream is reached under our own credentials; your identity is never forwarded to the model vendor.
Responsible disclosure
Found a vulnerability? We want to hear from you. Email security@scrip.ai with details and steps to reproduce. We'll acknowledge, investigate, and keep you updated. Please don't test against other customers' data or degrade the service for others while researching.
Compliance roadmap
Scrip is pre-launch. A SOC 2 Type II program and an independent penetration test are planned before general availability; this page will link the reports when they're available.