How Scowtt handles your data

Scowtt is designed around secure connections, controlled access and client-specific environments.

Our approach

• Secure connections: Data comes in through authenticated API connections, read-only CRM connections, or read-only access to a dataset you control, all managed with client-specific permissions.
• Read-only access to data you own: Wherever possible, Scowtt reads from systems you control, such as an S3 bucket or BigQuery dataset, rather than asking for shared credentials or write access. CRM connectors use standard OAuth, so no credentials are shared directly, and S3 access can be revoked on your side at any time.
• Your own environment: Each client's data, models and results are processed in a dedicated environment, with access limited to that client.
• No cross-customer use: Your data is never used to train, tune or evaluate models for other clients, and it's never pooled with other clients' data.
• Traditional machine learning: Lead scoring uses traditional machine learning models built for your business, not generative AI.
• No PII required: Scowtt creates predictive guidance without requiring personally identifiable information. Any email address or phone number used for ad platform matching is hashed with SHA-256 before it's sent.
• Data stays in the US: All of Scowtt's data centers are in the United States, and all data remains there.
• Compliance: Scowtt is compliant with GDPR and SOC 2.

Security practices

• Encryption: Your data is encrypted with AES-256 at rest, and with TLS 1.2 or higher in transit, with TLS 1.3 preferred.
• Penetration testing: Scowtt is tested by an independent third party every year. An executive summary is available under NDA.
• Incident response: Scowtt aims to notify you within 72 hours of a confirmed reportable breach, followed by a post-incident review.
• Backup and recovery: Automated backups and point-in-time snapshots support a recovery time objective of 24 hours, and recovery is tested at least once a year.
• Access control: Access to customer data is role-based and limited to what each person needs, and every production change is reviewed and tested before release.

Learn more

Scowtt is SOC 2 Type 2 certified, and the report is shared after an NDA. Please review here. You can request the report through the Trust Center, and Scowtt will approve your access.

Scowtt's Security Hub explains its security practices, infrastructure and data handling in more detail. The SOC 2 report, penetration test summary, data-flow overview and security questionnaire responses are all available under NDA. For security questionnaires, contact your Sales Rep or Account Manager.