Security at ScoutHalo.

ScoutHalo runs on modern, managed cloud infrastructure and follows standard practices to protect your account, your data, and access to the application. This page describes those safeguards in plain terms — and it reflects what is actually in place today, not certifications or controls we haven’t earned.

Security and privacy are different questions. This page covers operational safeguards; what information ScoutHalo collects and how it is used is covered in the Privacy Policy.

Accounts are handled by Supabase Auth. You can sign in with Google (OAuth) or with an email and password. Passwords are handled by the authentication provider — ScoutHalo never sees or stores them. Sessions are managed by the provider and kept on your device so your work follows you across sign-ins.

Signing in with Google can reduce the need to create another password. You remain responsible for protecting access to your identity-provider and ScoutHalo accounts.

ScoutHalo stores the work you create in the product: your projects, collections, Scout Reports, saved locations, and basic account information. It is synchronized so you can reach it from any device you sign in on.

Data is encrypted in transit (HTTPS/TLS) between your device and our services. At rest, it is held by managed infrastructure providers whose platforms encrypt stored data. Access is scoped per account: at the database layer, each account can reach only its own records. Application secrets are managed as environment configuration and are never committed to source control.

ScoutHalo is a scouting and production-planning tool. Avoid entering highly sensitive or confidential information unless it is genuinely necessary for your production workflow.

ScoutHalo is built on a small set of established providers, each handling one part of the product. They process data only to deliver their part of the service, as described in the Privacy Policy.

• Hosting: Vercel
• Database & authentication: Supabase (managed Postgres)
• AI processing: OpenAI
• Location & imagery data: SerpAPI, Foursquare, Mapillary
• Payments: Stripe
• Product analytics: Vercel Analytics

ScoutHalo uses AI to assist location discovery, evaluation, and production research. Its outputs are a starting point — they can be incomplete, and should be reviewed against local conditions before you rely on them for a production decision.

To provide these features, the prompts you write and the images you upload are processed by ScoutHalo and its AI and data providers. Only upload content you are authorized to use, and avoid entering anything you would not want processed by third-party services. How this data is handled is described in the Privacy Policy.

Production teams remain responsible for permits, access, safety, legal requirements, contracts, and every final production decision. ScoutHalo informs those decisions; it does not make them.

We describe our security honestly, which means being clear about its limits. ScoutHalo does not hold formal certifications such as SOC 2, ISO 27001, HIPAA, or a GDPR certification, and we don’t use marketing terms like “bank-level,” “military-grade,” or “100% secure.”

Security is an ongoing effort, not a finished state. If you find something that could be stronger, tell us through responsible disclosure above — we would rather hear it than imply a guarantee we can’t make.