Effective August 20, 2026
Security at OuttaScope
The controls protecting contractor and customer records.
Account protection
OuttaScope owns authentication directly: Argon2id password hashing, server-authoritative sessions, and server-side authorization on every private API request. Repeated failed sign-in attempts lock an account temporarily rather than allowing unlimited guesses.
Session security
A signed-in session is carried in an HttpOnly, Secure, SameSite cookie your browser cannot expose to page scripts, backed by a hashed session record on the server. Sessions expire automatically.
Tenant isolation
Every customer, project, extra, approval, export, and billing record belongs to one workspace. Database access runs under a least-privilege runtime role, and PostgreSQL row-level security policies -- enforced even for that role -- restrict every query to the authenticated workspace.
Approval links
Approval secrets use high-entropy tokens. Only a one-way hash is stored, links expire, decisions are single-use, and public endpoints are rate-limited.
Payment security
Card details are entered directly into Stripe's own checkout. OuttaScope's servers never receive or store your card number.
Infrastructure
Production traffic uses HTTPS. Security headers, request limits, structured audit events, dependency scanning, and least-privilege secrets reduce common web risks.
Report an issue
Send suspected vulnerabilities to hello@outtascope.ca. Do not access or change data that is not yours, and give us reasonable time to investigate before disclosure.
Launch note: these documents are a practical product baseline, not jurisdiction-specific legal advice. Counsel should review them before paid advertising begins.