Skip to content
Security & Reliability

Security Overview

Effective date: October 6, 2026 · Version 1.4

How ScaleIQ protects your data and operates the Service on Microsoft Azure.

This page summarizes how ScaleIQ protects your data and operates the Service. For detail under NDA, request our security package at trust@scale-iq.ai. ScaleIQ maintains reasonable security procedures and practices appropriate to the nature of the personal information, as required by Tex. Bus. & Com. Code § 521.052.

Security assurance

Customer Data is encrypted in transit (TLS 1.2 minimum) and at rest (AES-256), with keys managed in Azure Key Vault. Access is role-based, requires multi-factor authentication, and is reviewed quarterly. Service-to-service authentication uses managed identities with no stored secrets. A description of our technical and organizational measures is available to customers under NDA upon written request to trust@scale-iq.ai.

Built on Microsoft Azure

Hosting

The Service runs on Microsoft Azure — Azure Container Apps and Azure SQL (East US 2), with Azure Static Web Apps for the dashboard. Customer Data is stored in Microsoft Azure’s East US 2 region. Physical and platform security is inherited from Microsoft Azure.

Encryption

Data is encrypted in transit (TLS 1.2+) and at rest (AES-256) using Azure Key Vault. Sensitive personal information is encrypted in transmission and storage per Tex. Bus. & Com. Code § 521.052.

Tenant-scoped access

Customer Data is logically separated per tenant, and access is scoped at the application and database layers. AI inference is request-scoped and not pooled across customers. Tenant-scoped, least-privilege access is our design intent; we do not represent tenant isolation as an independently validated fact.

Identity & access

  • Microsoft Entra ID — SSO via SAML 2.0 / OIDC; all identity runs through your existing Entra ID.
  • MFA required for all ScaleIQ personnel.
  • Least privilege — production access is logged and reviewed quarterly. AssessIQ requests only read-only Microsoft Graph scopes needed for assessment.
  • Audit logs — exportable; 13 months retained by default, longer on enterprise plans.

Application security

  • Secure SDLC with mandatory peer review and CI gates.
  • Static analysis and dependency scanning on every build.
  • Centralized logging and monitoring via Azure Monitor / Application Insights and Microsoft Defender for Cloud.

Resilience

  • Daily encrypted backups; 35-day rolling retention.
  • Tested restoration.
  • RTO 4 hours · RPO 1 hour.
  • Status page: status.scale-iq.ai.

Breach notification — Texas law

In the event of a security breach involving sensitive personal information of Texas residents, ScaleIQ will:

  1. Notify affected individuals “as quickly as possible” following discovery, as required by Tex. Bus. & Com. Code § 521.053(b).
  2. If more than 250 Texas residents are affected, deliver written notice to the Texas Attorney General no later than thirty (30) days after the date ScaleIQ becomes aware of the breach (§ 521.053(l)).
  3. Provide the notice in the form required by law, including: the nature of the breach, the data categories affected, contact information for ScaleIQ, and steps affected individuals may take to protect themselves.
  4. Notify Customer within 48 hours of discovery to enable Customer’s independent notification obligations.

Incident response

ScaleIQ maintains a documented incident response playbook covering the following phases: (1) Detect — continuous monitoring and alerting via Azure Monitor; (2) Contain — isolation of affected systems and access revocation; (3) Eradicate — root cause remediation and patch deployment; (4) Recover — service restoration within RTO targets; (5) Notify — customer and regulatory notification per applicable law. Post-incident reviews are conducted for all material incidents. The internal runbook is available to enterprise customers under NDA upon written request.

Vulnerability disclosure

ScaleIQ maintains a responsible disclosure policy. Researchers who report security vulnerabilities to security@scale-iq.ai will receive:

  1. Acknowledgment within 24 hours.
  2. Severity triage within 72 hours.
  3. Remediation of Critical/High vulnerabilities within 30 days.
  4. Remediation of Medium vulnerabilities within 90 days.

ScaleIQ does not take legal action against good-faith security researchers who avoid privacy violations and service disruption, test only their own data, and give us reasonable time to remediate before public disclosure.

Shared responsibility

ScaleIQ secures the Service; customers are responsible for provisioning their users via Entra ID, enforcing MFA, configuring roles, reviewing audit logs, and maintaining valid tenant-administrator consent.

Contact

Security: security@scale-iq.ai · Trust & compliance: trust@scale-iq.ai
ScaleIQ, LLC · 240 W Galveston St, #1828, League City, Texas 77573