Security

An honest account of what's actually built, not a marketing page -- if something below isn't true yet, it says so.

Account protection

Two-factor authentication is mandatory for every account, not optional -- a password alone never creates a signed-in session. Time-based one-time codes (works with Google Authenticator, Authy, 1Password, and similar apps) are the primary method, with single-use backup codes and an email fallback for a lost device. Sessions automatically sign out after 30 minutes of inactivity, and after 12 hours regardless of activity, so a browser left open doesn't stay signed in indefinitely. Repeated failed login attempts on an account are rate-limited, and a password change, an authenticator reset, or a burst of failed logins all trigger an email to the account holder.

Data protection

Traffic to this site is encrypted in transit. Uploaded documents and their exports are encrypted at rest in cloud storage. Access to a document is limited to its owner, anyone the owner has explicitly and individually granted view access to, or a logged administrative override -- never a broader default. Every meaningful action (uploads, views, downloads, sharing, deletions) writes to an append-only audit log.

Application hardening

Every state-changing form is protected against cross-site request forgery. Response headers include a strict Content-Security-Policy (no inline scripts are allowed to run, by design) along with standard hardening headers (X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security). Every upload is validated against its actual file content, not just its filename or claimed type.

Where this is headed

This product is not yet SOC 2 certified and has not yet had an independent third-party penetration test -- both are on the roadmap as this moves from prototype toward a production customer base, not claimed today. If either of those matters for your organization's vendor review, ask -- we'd rather tell you directly where things stand than have you find out otherwise.

Reporting a vulnerability

If you've found a security issue, please report it to support@scopara.co rather than a public issue tracker or social media, so it can be addressed before it's disclosed publicly. Include enough detail to reproduce the issue if possible. A machine-readable version of this contact is also published at /.well-known/security.txt per RFC 9116.