CADABLE
LoginBook a demo
Security

Security at Scadable

How to report a vulnerability to us, and what we do today to protect the data you trust us with. This page describes what is in place now, not what we plan to have.

Report a vulnerability

If you think you have found a security issue in Scadable, email security@scadable.com. Please include:

  • what you found, and where: the URL, endpoint or repository
  • the steps to reproduce it
  • the impact you think it has
  • how we can reach you

We reply within five business days. When we confirm an issue, we rate its severity and fix it on the timeline that severity sets.

While you look, please test only against your own account and data. Do not access, change or delete anyone else's data, do not disrupt the service (no denial of service or load testing), and do not use social engineering or physical attacks. Give us a reasonable time to fix an issue before you share it publicly.

Our machine-readable contact file is at /.well-known/security.txt.

Email security@scadable.com

SOC 2

In progress

We are preparing for a SOC 2 audit, using our own product. No audit has taken place yet, so we do not have a SOC 2 report to share, and we have not had a third-party penetration test. Our security policies are written and in review.

What we do today

  • HostingMost of our production services and the main database behind your workspace run in Google Cloud's Toronto region, on Google Kubernetes Engine with private nodes. Some older systems on DigitalOcean still hold data while we finish moving them to Google Cloud.
  • DatabaseThe main database has no public IP address and accepts only encrypted connections. Our services sign in to it with their Google Cloud identity, not a stored password.
  • Separation between customersIn the services behind your workspace on Google Cloud, each customer's rows are kept apart by Postgres row-level security, which applies to the tables' owners too. None of the database roles those services use can bypass it.
  • BackupsThe main database is backed up every day, and we keep the last 14 daily backups, stored in Google Cloud's United States multi-region. Point-in-time recovery is turned on, with 7 days of transaction logs.
  • EncryptionData stored in Google Cloud is encrypted at rest by Google, and our sites and API are served over HTTPS. Credentials for tools you connect, such as Slack tokens, are encrypted by our application before they are stored.
  • Secrets and accessCredentials for our Google Cloud services are kept in Google Secret Manager, and our Google Cloud organization does not allow service account keys to be created. Our GitHub connector uses short-lived tokens, each scoped to a single repository.
  • Sign-inCustomers and staff sign in to Scadable through Auth0. Our staff console checks on every request that the person belongs to our staff organization.
  • VendorsOur trust center lists our main subprocessors and where each one processes data.

Our trust center lists our subprocessors, the controls we hold ourselves to and their status, and answers to common questions.

Open the trust center