Security at Scholars Copilot

Security is built into Scholars Copilot

Scholars Copilot is designed with security and privacy as core engineering principles, not as an afterthought.

We protect the data entrusted to us through layered technical and operational controls covering application security, tenant isolation, access control, encryption, infrastructure, integrations, and incident response.

Our security program incorporates principles from OWASP application security guidance, SOC 2 Trust Services Criteria, and established cloud security practices.

Protecting your data

Encryption

Data is protected using encryption in transit and encryption at rest across supported systems.

We use secure connections for communication between users, Scholars Copilot services, and third-party services.

Tenant isolation

Scholars Copilot is built as a multi-tenant platform. Customer data is logically isolated between organizations.

Authorization checks are enforced server-side so that users can only access resources belonging to their organization and permitted role.

Tenant isolation is treated as a critical security requirement and is covered by automated security tests.

Access control

Access to customer and system data follows the principle of least privilege.

Role-based permissions help ensure that users, employees, and services receive only the access required for their responsibilities.

Privileged access is protected with multi-factor authentication and monitored through appropriate logging.

Secure document handling

Documents uploaded to Scholars Copilot are stored using protected storage rather than publicly accessible locations.

Access to protected documents is authorized before access is granted, with additional controls applied to sensitive file operations.

Application security

Security is incorporated throughout our software development lifecycle.

Our engineering practices address common application security risks including:

• Authentication and authorization
• Access control
• Input validation
• Injection vulnerabilities
• Cross-site scripting
• Secure session management
• Secure file handling
• API security
• Rate limiting
• Sensitive information exposure

We use OWASP security guidance as an important reference for application security and continuously improve our controls as the platform evolves.

Secure development

Security checks are incorporated into our development and deployment workflows.

Depending on the component, these include:

• Dependency vulnerability scanning
• Secret detection
• Static analysis
• Automated security tests
• Authentication and authorization tests
• Tenant-isolation tests
• Code review
• Controlled production deployments

Security issues identified through these processes are tracked and prioritized according to their severity and potential impact.

Infrastructure security

Scholars Copilot uses managed cloud infrastructure and security controls designed to reduce unnecessary exposure.

Our infrastructure practices include:

• Restricted production access
• Multi-factor authentication for privileged access
• Secure secrets management
• Encrypted storage
• Protected databases
• Environment separation
• Automated backups
• Security logging and monitoring
• Controlled deployment processes

Production credentials and secrets are not stored in source code.

AI & third-party services

Scholars Copilot integrates with third-party services, including AI providers and other business integrations.

We evaluate the data shared with these services and aim to minimize the information transmitted to what is necessary for the requested functionality.

Where applicable, our AI integration architecture provides centralized control over:

• Provider credentials
• Data routing
• Access controls
• Usage monitoring
• Rate limits
• Tenant attribution

Customer-provided AI credentials are protected and are not exposed to end users through the browser.

Operational security

Security is also an operational responsibility.

We maintain documented processes covering:

• Access management
• Security incidents
• Vulnerability management
• Data retention
• Backup and recovery
• Employee onboarding and offboarding
• Vendor management
• Security reviews

Access to sensitive systems is reviewed periodically, and access is removed when it is no longer required.

Backup & recovery

We maintain automated backups for critical systems and restrict access to backup data.

Our recovery procedures are periodically tested so that backups are not simply created, but can also be used to restore services and data when required.

We continuously improve our recovery capabilities as the platform grows.

Security monitoring & incident response

We monitor security-relevant events and maintain an incident response process for investigating and responding to potential security incidents.

Our response process includes:

If a security incident affects customer data, we will follow our incident response procedures and applicable contractual and legal requirements.

Responsible disclosure

If you believe you have discovered a security vulnerability in Scholars Copilot, we encourage responsible disclosure.

Please report security issues to:

Please include enough information for our team to reproduce and investigate the issue. We ask security researchers not to access, modify, or disclose other customers' data while investigating a potential vulnerability.

Security as we grow

Security is an ongoing process.

As Scholars Copilot grows, we are continuing to strengthen our security program, expand automated controls, conduct appropriate security testing, and align our practices with recognized industry frameworks.

Our long-term security roadmap includes independent assurance as our customer and business requirements mature.

Security questions

Enterprise customers and partners can contact us for additional information about our security practices, architecture, data handling, and subprocessors.