What is built, and what is not.

Written like a document control table. If something is planned or not held, it says so.

This is an engineering description of Scrivica today. It is not a contract term. See the subprocessor list and the cookie notice.

Request a Security Review

Document control, Scrivica security summary
Item	Status	Detail
Audit trail	Built	Written by database triggers, so app code cannot skip it. Actor, database time, and old and new values. Append only against the app and signed-in users. The database owner is outside that protection. A purge of an organization removes its audit trail, so export first.
Electronic signature	Built	The signer re-enters their password. The record keeps the meaning of the signature, the signer, the time and a hash of the signed content. A signature with no meaning is refused.
Tenant isolation	Built	Every row carries an organization id and is protected by row level security. Source files sit in a private bucket.
Access control	Built	Invite-only sign-up. Six roles. Optional authenticator app sign-in that an organization admin can require.
Platform staff access	Built	Support views need a reason, last 60 minutes, are logged and are shown to your admins. Content access needs a grant from your admin.
Data export	Built	An organization admin can download all organization data as one archive, including while the organization is locked.
AI provider	Built	Anthropic processes text sent to AI features. The browser never calls a model. An organization can bring its own key. Text is not redacted before it is sent.
Subprocessors	Built	Six named providers, published, with what each one receives. Vendor regions are still to be confirmed.
Zero data retention	Planned	Not in place. Anthropic's standard API retention applies to the platform key today.
Data retention schedule	Planned	Contract-end handling is defined. Retention for the audit trail and source files during an active contract is not yet decided.
Validation package	In Preparation	You validate; we supply the package.
SOC 2	Not Held	Scrivica is not SOC 2 certified, and we do not claim it.
Business associate agreement	Not Held	No BAA is in place with Scrivica or its providers.

Document control, Scrivica security summary

Audit trail

Built

Written by database triggers, so app code cannot skip it. Actor, database time, and old and new values. Append only against the app and signed-in users. The database owner is outside that protection. A purge of an organization removes its audit trail, so export first.

Electronic signature

Built

The signer re-enters their password. The record keeps the meaning of the signature, the signer, the time and a hash of the signed content. A signature with no meaning is refused.

Tenant isolation

Built

Every row carries an organization id and is protected by row level security. Source files sit in a private bucket.

Access control

Built

Invite-only sign-up. Six roles. Optional authenticator app sign-in that an organization admin can require.

Platform staff access

Built

Support views need a reason, last 60 minutes, are logged and are shown to your admins. Content access needs a grant from your admin.

Data export

Built

An organization admin can download all organization data as one archive, including while the organization is locked.

AI provider

Built

Anthropic processes text sent to AI features. The browser never calls a model. An organization can bring its own key. Text is not redacted before it is sent.

Subprocessors

Built

Six named providers, published, with what each one receives. Vendor regions are still to be confirmed.

Zero data retention

Planned

Not in place. Anthropic's standard API retention applies to the platform key today.

Data retention schedule

Planned

Contract-end handling is defined. Retention for the audit trail and source files during an active contract is not yet decided.

Validation package

In Preparation

You validate; we supply the package.

SOC 2

Not Held

Scrivica is not SOC 2 certified, and we do not claim it.

Business associate agreement

Not Held

No BAA is in place with Scrivica or its providers.