ScopeKeep is designed for sensitive commercial relationships: separate tenants, private client records, authoritative payment state, and auditable decisions.
Architecture principles
Defense follows the data, not the route name.
The product model treats interface hiding as convenience, never authorization. Every sensitive surface is expected to enforce access at multiple layers.
Tenant isolation
Workspace, client, and app boundaries are designed to be enforced in Postgres with Row Level Security—not only hidden in the interface.
Role-aware visibility
Provider members, client approvers, requesters, billing contacts, and contractors receive distinct permissions and record scopes.
Protected authentication
The application architecture calls for secure sessions, MFA support, recovery controls, session revocation, and reauthentication for sensitive actions.
Private files
Client documents and attachments are private by default, delivered with expiring access, validated, scanned, and governed by retention policy.
Encrypted integrations
OAuth is preferred over copied tokens. Refresh credentials remain server-only, encrypted with versioned keys, and redacted from logs and operations views.
Auditable decisions
Membership changes, scope decisions, quote acceptance, payment actions, ledger adjustments, and release publication create durable audit history.
Payment state comes from the payment system.
ScopeKeep is designed to use Stripe-hosted collection and verified events. A browser redirect never marks an invoice paid, and a payment-gated quote never becomes work while payment is merely processing.
Signed, idempotent webhooksProvider signatures and account context are verified before events can update normalized billing records. Retries cannot duplicate financial actions.
Separate billing relationshipsScopeKeep SaaS billing remains distinct from provider-owned client charges. Connected-account identity is checked on every relevant event.
Reconciliation and recoveryProcessing delays, failed payments, disconnected accounts, disputes, and duplicate events are explicit states with safe recovery paths.
Architecture commitments are not certification claims.
This page describes ScopeKeep’s intended security architecture. It does not claim SOC 2, ISO 27001, penetration-test completion, or a contractual SLA. Production controls and public legal documents must be validated before paid launch.