Effective October 8, 2026.

Data Protection Policy

How Total Cladding and Roofing LLC protects the information held in ScopeFlow. This sits alongside the Privacy Policy, which explains what we collect and why.

Tenant isolation

Each organisation’s data is isolated at two independent layers: every record carries its organisation, and the database itself enforces row-level security so a query can only reach the organisation it runs for. The application connects to the database as a restricted role. In Estimating, Project Management and Roof Report, cross-organisation access exists only for platform operators, is limited to named actions, and is written to an audit log before it is possible. The CRM keeps its records in a separate database built the same way, with row-level security on every table; our operators’ actions on a company’s CRM account are limited to named ones, such as setting up or pausing its phone account, and each is recorded with who did it. Some things are private to one person even inside their company — their personal mailbox (except an email they choose to file), their daily digest, the phone number on their profile and their private tasks — and are shown to nobody else.

Access control

Access requires both membership of an organisation and a seat on a live licence. Administrators control roles and seats. Sign-in uses individual accounts with password or emailed one-time links; we never ask for passwords by email or telephone.

Sessions and passwords

Passwords must be at least 12 characters; the sign-in service enforces the same rule as the application, and passwords are never stored in plain text or sent by email. Set-password and sign-in links sent by email work once and expire after about an hour. Signing out ends the session on that device; an administrator can end every session for a user on every device at once (Settings → Users → Sign out everywhere), after which that user must sign in again. Revoking a seat removes access within about a minute while keeping the person’s history.

The iPhone app

The app keeps its sign-in in the iPhone’s Keychain, never in plain storage, and talks to ScopeFlow over encrypted connections only. Files you open in the app are kept in its cache on your iPhone until you sign out. With Require Face ID turned on (it is off by default), the app asks for Face ID or the iPhone’s passcode when it opens and when you come back after five minutes away, before anything from the CRM shows; the iPhone checks it, and nothing about it reaches us.

Encryption and hosting

Data is encrypted in transit and at rest by our hosting and database providers. The access that connected accounts grant — mailboxes, calendars, Facebook Pages, a company’s own AI keys and phone-account secrets — and the push tokens of phones that take notifications are encrypted again with AES-256-GCM before they are stored, and never sent to a browser or the app.

Files and recordings

Uploaded documents, email attachments, call recordings and voicemails are stored in private storage and served only to signed-in members of the owning organisation who may see them, through links that stop working within minutes. A copy of a company’s data that it asks us for is delivered through links that work for 7 days. Pictures in a Sales email’s design are the one exception: the email links to them for ten years, so its reader’s mail app can show them.

Messages from other services

Deliveries from Twilio, Meta, the payment provider and other services that send us data on a company’s behalf are accepted only when they carry a valid signature, key or token, and a company’s web forms only with a signed token from a page we served within the last three days, behind a hidden bot trap and a per-visitor limit; each is recorded, then processed — never trusted on arrival. Resend’s reports on email that is not the Sales tab’s are answered and not kept.

Audit trail

Changes to estimates, databases, settings and user access are recorded with who made them and when. Platform-operator actions are recorded separately, with before-and-after detail. Exports and erasures of a person’s data are recorded with their counts, never the data.

Third parties

The providers who handle information for us, and what each receives, are listed in the Privacy Policy (Who handles it for us). AI features send the provider what that feature needs, for that request; Anthropic, our default AI provider, deletes it within 30 days and does not train on it. Notifications to the iPhone app go through Expo’s push service to Apple’s; they carry a notice’s title, never the body of an email, a text or a note, and Expo does not store what they say. Payment card details are handled by the payment provider only.

Backups and recovery

Before any change to the structure of a production database, the database is backed up and the copy checked for completeness before the change is made. Backups are kept on encrypted storage that only our administrators can reach.

Incidents

If we become aware of a breach affecting your organisation’s data we will tell your administrators without undue delay, describe what happened and what we are doing, and cooperate with any notification you are required to make.

Your part

Keep your login to yourself, revoke seats promptly when people leave, protect your iPhone with a passcode, and use the Support page to report anything that looks wrong. Questions about this policy: support@scopeflow.us.

ScopeFlow is operated by Total Cladding and Roofing LLC. Post: 5900 Balcones Dr Ste 100, Austin, TX 78731-4298, United States Phone: +1 (210) 775-0995 Email: support@scopeflow.us