# Vendor risk management questionnaire - Scope responses

Generic VRM questionnaire covering the questions enterprise procurement
teams ask outside of SIG or CAIQ. Current as of 2026-05-31.

---

## Company and product

**Q: What does the product do?**
Scope is an AI-dispatched legal vendor procurement platform. Firms ask
their AI assistant for a litigation vendor; Scope returns named vendors
with computed prices, runs the dispatch, processes firm-to-vendor
payment, and writes the audit record to completion.

**Q: Where is data hosted?**
United States (US-East). Vercel for application hosting, Supabase for
database, authentication, and storage.

**Q: Who are the subprocessors?**
Vercel (hosting), Supabase (database/auth/storage), Stripe (payments),
Resend (transactional email). All maintain SOC 2 Type II.
Starting November 4, 2026: Google (Google Maps Platform, Geocoding API)
for address geocoding. It receives the service address only.

## Data handling

**Q: What customer data does Scope store?**
Matter metadata (matter name, jurisdiction, parties, vendor category,
budget), vendor records, dispatch and payment records, and the audit
log. Scope does NOT store firm client files or the firm's client list.

**Q: Does Scope perform conflict checks?**
Scope runs a dispatch-time conflict gate: professionals with declared
relationships to the matter's named adverse parties are filtered before
the dispatch reaches them, and the result is recorded on the matter.
Scope does not search the firm's CMS or client list, and
prior-representation clearance remains the firm's own process.

**Q: Is data segregated by customer?**
Yes. Row Level Security on every tenant-scoped table enforces isolation
at the database layer. The administrative database client is used only in genuine
admin paths (audit writes, payment webhooks, internal analytics) and is
never reachable from a tenant request.

**Q: How is data deleted?**
Hard-delete with cascade on tenant-initiated deletion. Secrets are
cryptographically erased. Audit records are retained by design as the
compliance record.

## Security controls

**Q: Encryption?**
TLS 1.2+ in transit. AES-256 at rest (Postgres). AES-256-GCM for
secrets. API tokens stored as SHA-256 hashes.

**Q: Authentication?**
OAuth 2.0 access tokens, personal access tokens for CI, and SSO (SAML
2.0 + OIDC) configurable per tenant. RBAC with five roles and
capability-based gating.

**Q: Audit logging?**
Append-only tenant-scoped audit log across matter, award, roster,
billing, admin, and export mutations, carrying actor, IP, user agent,
and before/after state. Exportable as CSV and PDF, per
matter, date range, or firm.

**Q: Rate limiting?**
Per-tenant, default 1000 req/min, configurable. Rate-limit headers on
every response.

## Compliance

**Q: SOC 2?**
Type I in preparation; security controls in place today, formal audit engagement being finalized. Type II after Type I.

**Q: HIPAA?**
BAA available on the claims vertical, per vendor at onboarding. The legal
vertical does not process PHI.

**Q: Cyber insurance?**
Cyber: 1M aggregate, 10K retention. E&O: 1M limit, 25K retention
(includes 1M media liability). GL: 1M per occurrence / 2M aggregate.
Higher limits (5M+) are on the post-launch roadmap as enterprise deals require.

**Q: Penetration testing?**
Dependency scanning in CI today. A formal third-party pen-test cadence is
on the post-launch roadmap (target Q3-Q4 2026).

## Business continuity

**Q: Backups?**
Supabase automated daily backups with point-in-time recovery.

**Q: Disaster recovery?**
RPO is bounded by Supabase PITR. Formal RTO/RPO targets and a tested DR
runbook are on the post-launch roadmap.

## Integration and portability

**Q: Can we integrate with our ELM / CMS?**
Yes. REST API with OpenAPI 3.1 spec, inbound matter sync endpoint, LEDES
1998B billing export, and audit export. Reference architectures
published for TeamConnect, Passport, Onit, Clio, and 8am Legal
(CASEpeer / MyCase). Live connectors are partner-deal triggered.

**Q: Can we export our data?**
Yes. LEDES 1998B billing export, CSV and PDF audit export, and a
carrier feed (a signed URL that explains every dollar on a matter).