The controls compliance teams need, stated honestly
Scribase is an application cloud — flat-priced, fully exportable, and built for teams that need an auditable, portable backend. Enterprise capabilities are added incrementally; each one below shows its real shipping status so you can plan around what is actually available.
What is available and what is coming
Every capability below shows its real status. Nothing is listed as available unless it ships today.
SSO — SAML 2.0 and OIDC
Connect Scribase to your identity provider over OIDC or SAML 2.0. Team members sign in through your existing IdP, people on your verified email domains can join automatically with a role you choose, and you can require SSO for everyone except owners.
Team audit logs
Every mutating API call is written to an append-only organization audit log: actor, action, resource, and time. Browse it under Audit logs in the console, or page through GET /v1/organizations/{org}/audit-events to feed your SIEM or a DPA evidence bundle.
BYOC — run in your own cluster
Deploy the Scribase Helm chart (deploy/helm/scribase) into your own Kubernetes cluster. Same verified restore, preview branches, and CLI as managed Scribase — with least-privilege operator roles and no cluster-admin in workloads.
Written support terms
Self-host support includes a written agreement with incident response windows and escalation paths. Hosted plans run on a commercially reasonable-efforts basis with no uptime guarantee (see the Terms); contact us if you need written uptime terms.
Dedicated support channel
A shared Slack or Teams channel with your account team for questions, incident escalation, and migration help. Available today with self-host support.
Custom data processing agreement
A standard DPA is available for all paid plans. Enterprise teams needing custom data residency terms, sub-processor lists, or jurisdiction-specific clauses — reach out and we will work through it.
What the platform provides today
These are properties of the running system, not aspirational controls.
| Control | Status | Details |
|---|---|---|
| Encryption in transit | Available | TLS 1.2+ enforced for all client connections and control plane traffic. |
| Encryption at rest | Available | Managed instances use encrypted block storage. BYOC inherits your cluster policy. |
| Row-level security | Available | Postgres RLS enforced at the database level, with policy cost linting to keep it switched on. |
| Verified backup restore | Available | Row-count parity, checksums, policy parity, and login proof included in every restore. |
| Secret-scrubbed previews | Available | Preview branches strip production secrets; branches are TTL-swept on PR close. |
| Idempotent, auditable operations | Available | Every mutating API call carries an idempotency key and an operation ID. |
| SSO (SAML 2.0 / OIDC) | Available | Signed SAML assertions and OIDC ID tokens are verified against your IdP; SSO can be required for all non-owners. |
| Team audit logs | Available | Append-only, structured JSON, paginated over the /v1 audit-events API and viewable in the console. |
| SOC 2 Type II | Planned | The technical controls that a SOC 2 audit examines are in place. Formal attestation is planned. |
Ready to talk?
Tell us what you are building and we will walk through whether Scribase fits your security and operational requirements.
Enterprise questions
Is SSO available today?
Yes. Open Single sign-on in the console, connect an OIDC provider (issuer, client ID, client secret) or a SAML 2.0 IdP (metadata XML or entity ID, sign-on URL, and certificate), verify your email domain with a DNS TXT record, and run the connection test. Requiring SSO is a separate switch that only unlocks after a passing test, and owners stay exempt so a broken IdP cannot lock you out.
What does BYOC mean for Scribase?
Bring Your Own Cloud means running the Scribase control plane and data plane inside your own Kubernetes cluster. You retain full custody of your data; Scribase provides the operator, Helm chart, and upgrade path. The Helm chart ships today in deploy/helm/scribase.
What SLA is included with self-host support?
Self-host support ($2,000 a year) includes a written response-time commitment for incidents and upgrades. The exact targets are stated in the support agreement. Contact us for custom terms.
How are audit logs stored and exported?
Audit logs are written as structured JSON — one append-only record per mutating call with timestamp, actor, action, resource kind and id, and request metadata. Page through them with GET /v1/organizations/{org}/audit-events or scribase audit list, so you can ship them to your SIEM without building a screen-scraping pipeline.
Can I get a custom data processing agreement?
Yes. A standard DPA is available for all paid plans. For custom terms, jurisdiction-specific clauses, or sub-processor review, email support@scribase.com and your account team will take it from there.
What happens to my data if I stop using Scribase?
Run scribase export and you get a portable bundle of your schema, data, auth users, storage objects, and RLS policies. That bundle imports cleanly into a Postgres instance of your choice. There is no exit fee.