The controls compliance teams need, stated honestly
Scribase is an application cloud — flat-priced, fully exportable, and built for teams that need an auditable, portable backend. Enterprise capabilities are added incrementally; each one below shows its real shipping status so you can plan around what is actually available.
What is available and what is coming
Every capability below shows its real status. Nothing is listed as available unless it ships today.
SSO — SAML 2.0 and OIDC
Connect Scribase to your identity provider over OIDC or SAML 2.0. Team members sign in through your existing IdP, people on your verified email domains can join automatically with a role you choose, and you can require SSO for everyone except owners.
Team audit logs
Every mutating API call is written to an append-only organization audit log: actor, action, resource, and time. Browse it under Audit logs in the console, or page through GET /v1/organizations/{org}/audit-events to feed your SIEM or a DPA evidence bundle.
BYOC — run in your own cluster
Run Scribase in your own Kubernetes cluster from our Helm chart, under a written agreement. Same verified restore, preview branches, and CLI as managed Scribase — with least-privilege operator roles and no cluster-admin in workloads.
Written support terms
Hosted plans run on a commercially reasonable-efforts basis with no written uptime commitment (see the Terms). If you need written response times, tell us what you need and we will say plainly what we can commit to.
Dedicated support channel
A shared Slack or Teams channel for questions, incident escalation, and migration help, set up with an enterprise agreement.
Custom data processing agreement
A standard DPA is available for all paid plans, and the sub-processor list is public. The hosted service runs in one region today, Frankfurt, Germany. For jurisdiction-specific clauses, reach out and we will work through it.
What the platform provides today
These are properties of the running system, not aspirational controls.
| Control | Status | Details |
|---|---|---|
| Encryption in transit | Available | TLS 1.2+ enforced for all client connections and control plane traffic. |
| Encryption at rest | Available | Managed instances use encrypted block storage. BYOC inherits your cluster policy. |
| Row-level security | Available | Postgres RLS enforced at the database level, with policy cost linting to keep it switched on. |
| Verified backup restore | Available | Row-count parity, checksums, policy parity, and login proof included in every restore. |
| Secret-scrubbed previews | Available | Preview branches strip production secrets; branches are TTL-swept on PR close. |
| Idempotent, auditable operations | Available | Every mutating API call carries an idempotency key and an operation ID. |
| SSO (SAML 2.0 / OIDC) | Available | Signed SAML assertions and OIDC ID tokens are verified against your IdP; SSO can be required for all non-owners. |
| Team audit logs | Available | Append-only, structured JSON, paginated over the /v1 audit-events API and viewable in the console. |
| SOC 2 Type II | Planned | The technical controls that a SOC 2 audit examines are in place. Formal attestation is planned. |
Ready to talk?
Tell us what you are building and we will walk through whether Scribase fits your security and operational requirements.
Enterprise questions
Is SSO available today?
Yes. Open Single sign-on in the console, connect an OIDC provider (issuer, client ID, client secret) or a SAML 2.0 IdP (metadata XML or entity ID, sign-on URL, and certificate), verify your email domain with a DNS TXT record, and run the connection test. Requiring SSO is a separate switch that only unlocks after a passing test, and owners stay exempt so a broken IdP cannot lock you out.
What does BYOC mean for Scribase?
Bring Your Own Cloud means running the Scribase control plane and data plane inside your own Kubernetes cluster. You retain full custody of your data; under a written agreement, Scribase provides the operator, the Helm chart, and the upgrade path.
Is there an SLA?
Not on hosted plans today: they run on a commercially reasonable-efforts basis, as the Terms say. If you need written response times, email support@scribase.com and we will tell you plainly what we can commit to.
How are audit logs stored and exported?
Audit logs are written as structured JSON — one append-only record per mutating call with timestamp, actor, action, resource kind and id, and request metadata. Page through them with GET /v1/organizations/{org}/audit-events or scribase audit list, so you can ship them to your SIEM without building a screen-scraping pipeline.
Can I get a custom data processing agreement?
Yes. A standard DPA is available for all paid plans, and the sub-processors are listed at /legal/subprocessors. For custom terms or jurisdiction-specific clauses, email support@scribase.com.
What happens to my data if I stop using Scribase?
Run scribase export and you get a portable bundle of your schema, data, auth users, storage objects, and RLS policies. That bundle imports cleanly into a Postgres instance of your choice. There is no exit fee.