Skip to content

Security Overview

Last updated: August 2026

1. Security overview

SCREDIT holds credit applications, financial statements, trade references, and receivables data on behalf of the organizations that use it. This overview describes how that data is separated, who can reach it, how changes reach production, and what we have not yet done. It is written to be checked rather than believed: where a control has an enforcement mechanism, we name the mechanism.

2. Administrative, technical, and organizational safeguards

  • Role-based access control, tenant-aware authorization, and least-privilege operational access.
  • Encryption in transit and at rest for sensitive platform and business information, with secret handling separated from application configuration.
  • Centralized logging, monitoring, incident response, backup, and recovery procedures.
  • Secure development lifecycle practices including peer review, dependency management, and vulnerability remediation workflows.
  • Static analysis, dependency scanning, and dynamic application security testing run against the platform. We have not commissioned an independent third-party penetration test, and our own scanning is not a substitute for one.

3. Platform architecture and tenant isolation

Each customer's data is held in its own database schema rather than separated by a filter on a shared table — isolation is structural, not a query condition someone has to remember to apply.

Permissions are enforced at the API boundary per action, not only hidden in the interface: read and write are distinct rights, and a request without the right one is refused server-side.

Inbound webhooks from banking and integration providers are signature-verified before the payload is trusted, with unverified delivery disabled in production and that setting checked by an automated build gate.

The platform runs on cloud infrastructure operated by EFILOS, comprising identity, relational database, object storage, messaging, caching, and observability services, with environment-level access restrictions between them.

4. Incident response

EFILOS maintains documented processes for detection, escalation, investigation, containment, remediation, and communication relating to security incidents. Where contractually required, customers will be notified without undue delay after confirmation of a reportable incident affecting customer data.

5. Business continuity

  • Backup and restoration procedures for key systems and data stores.
  • Recovery planning and environment management practices for service resilience.
  • Operational monitoring to detect availability, performance, or security anomalies.

6. Compliance status

Controls designed around SOC 2 principles — a readiness program, not yet a completed third-party audit; we state our status plainly.

Certification is on the roadmap, sequenced with our first production customers rather than run against an empty platform — if it is a procurement gate for you, tell us early and we will treat it as one.

SCREDIT is designed around FCRA and ECOA obligations and records a full audit trail for every decision. Privacy commitments are set out in the Privacy Policy and the Data Processing Agreement.