Legal & Trust
Security at Scarlet Risk
Scarlet Risk helps small businesses manage risk, so we hold ourselves to the same standard. This page describes what we do today, in plain language. It is updated as our program grows. Last updated: October 20, 2026.
How we protect your data
- Encryption. Data is encrypted in transit with TLS and at rest by our infrastructure provider.
- Evidence files. Files you upload are encrypted with AES-256-GCM before they are stored. Each file gets its own key, and that key is itself encrypted under a master key held in our backend secrets, never in the browser. Files live in private storage with no public URLs.
- Connected accounts. Access tokens for integrations such as Google Workspace and GitHub are encrypted the same way.
- Access. Each customer account can see only its own data, enforced in the database. Access to production systems is limited to the founder.
- Logging. Activity by AI tools connected to your account is logged.
How we use AI
- AI features use models from Google (through our AI gateway) and, for the website chat assistant, Anthropic.
- We send only what a feature needs to answer your request, such as your company profile, policy text, or vendor names. Details are in our AI Addendum.
- We do not sell customer data.
- Scarlet Risk does not train AI models on customer data.
Where your data lives and how long we keep it
Data is hosted with our infrastructure provider. Cancelling ends access at the end of your billing period. To have your account data and uploaded files deleted, email pete@scarletrisk.com and we will delete them within 30 days.
Who processes your data
| Provider | Purpose |
|---|---|
| Supabase / Lovable Cloud | Database, file storage, sign-in |
| Google (via Lovable AI gateway) | AI-generated content |
| Anthropic | Website chat assistant |
| Stripe | Payments (we never see card numbers) |
| Resend; Lovable email | Transactional and notification email |
| Make | Routing of sales and sign-up leads |
| Have I Been Pwned | Breach checks for the domains and emails you ask us to check |
| Google Analytics, HubSpot, Apollo, PostHog, Mixpanel | Website and product analytics, described in our Privacy Policy |
We notify customers of material changes to this list.
Incident response
We maintain a written incident response plan. If an incident affects your data, we will notify you within 72 hours of confirming it, with what we know and what we are doing.
Compliance status
Scarlet Risk is a new company and has not yet completed a third-party SOC 2 audit. We follow the practices described on this page, and we complete customer security questionnaires and provide our DPA on request.
Report a security issue
Email pete@scarletrisk.com. We acknowledge reports within 2 business days and will not pursue good-faith researchers.