Security, privacy, and auditability for Google Vault investigations

1. Platform security model

ScoopVault is a multi-tenant investigation platform for Google Workspace data. Each customer organisation is logically isolated by tenant ID at the application and database layer. Users can only access the matters, jobs, exports, findings, reports, and audit records associated with their assigned tenant and authorised role.

Tenant isolation is enforced by backend role and tenant checks, not only by frontend user interface restrictions. This ensures that access controls remain in place even if a user attempts to call application APIs directly.

2. Hosting and infrastructure

ScoopVault production services are hosted on Google Cloud Platform in the London region (europe-west2, United Kingdom), with encrypted backups replicated to independent object storage operated by Hetzner in Finland (EU). The platform uses separate application, database, cache, queue, and storage components to support investigation processing, auditability, exports, and service reliability.

The private key required to decrypt backups is held offline and is never stored on any server.

3. Authentication and session security

ScoopVault uses Google OAuth for authentication. ScoopVault does not store or manage customer passwords. Users authenticate through Google, and ScoopVault issues time-limited application sessions after successful authentication and authorisation.

• Google OAuth-only authentication
• Session duration of 60 minutes
• Sensitive administrative actions apply additional server-side session checks
• Logout invalidates sessions server-side using a Redis denylist
• Redis failure is treated conservatively for session validation
• Role-based access is enforced server-side

4. Roles and access boundaries

ScoopVault uses role-based permissions to separate platform administration from customer investigation activity.

5. Google Workspace access

ScoopVault accesses Google Workspace data only through OAuth permissions granted by an authorised customer organisation. The platform requests the minimum Google permissions required to provide investigation, export, account identity, and evidence management functionality.

ScoopVault does not request any Gmail or Google Drive scopes. Email evidence enters the platform exclusively as point-in-time Google Vault exports; the platform never reads live mailboxes or Drive files, sends email through customer accounts, or alters customer data in Google Workspace.

ScoopVault currently uses customer-authorised OAuth for Google Workspace access. Domain-wide delegation may be offered as a future enterprise deployment option for customers that prefer administrator-managed access.

6. Google API Limited Use

ScoopVault's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data obtained through Google APIs is used only to provide user-facing eDiscovery, investigation, reporting, evidence management, and audit functionality requested by the authorised customer organisation.

ScoopVault does not use Google Workspace data obtained through Google APIs for advertising, unrelated analytics, user profiling, sale to third parties, or training general-purpose AI models.

7. Data processed by ScoopVault

Depending on the customer's configuration and investigation activity, ScoopVault may process the following categories of data:

• Google Vault matters, searches, exports, and related metadata
• Email messages from Vault exports: headers, recipients, subjects, timestamps, body content, and attachments
• MBOX and EML exports generated from authorised Vault searches
• Investigation matters, job names, search criteria, and query metadata
• AI-generated summaries, findings, cases, timelines, risk indicators, and reports
• Chain of custody records and integrity verification data
• Audit logs, user actions, authentication events, and administrative events
• User account metadata, including name, work email address, role, and tenant assignment

8. AI-assisted analysis

AI-assisted analysis is available by default to pilot workspaces, within ScoopVault’s entitlement and cost controls. ScoopVault accesses Claude models through Google Cloud (Vertex AI) in the europe-west1 region (Belgium, EU) to support investigation workflows such as summarisation, review-signal identification, timeline generation, clustering, question answering, and report drafting. Google provides the managed AI inference service; Anthropic is the publisher/licensor of the Claude models and, under this approved route, does not receive investigation content, prompts or outputs directly. Exact and Connected search do not use an AI model. AI analysis is used to assist human review, not to replace legal or compliance judgement.

When AI-assisted analysis runs, relevant excerpts, metadata, summaries, and documents may be sent to the AI provider solely to generate the requested investigation output.

Customer data is not used to train third-party AI models. ScoopVault does not permit customer investigation data, Google Workspace content, prompts, outputs, summaries, reports, or exports to be used for third-party AI model training, except where expressly agreed in writing by the customer.

AI findings are advisory only. Reviewers should return to the raw emails, exported records, chain of custody PDFs, integrity checks, and recorded actions before making legal, regulatory, employment, or compliance decisions.

9. Evidence records and auditability

ScoopVault is built around auditable investigation workflows. The platform records key actions so that customers can understand who did what, when, and in relation to which matter or job.

• Login and logout events
• Matter creation and investigation setup
• Search jobs and export activity
• AI analysis runs and generated findings
• Evidence flagging and review actions
• Report generation and evidence downloads
• Administrative changes
• Team invitations and invite lifecycle actions

ScoopVault supports chain of custody PDFs, cryptographic hashes, integrity verification, and audit log CSV exports. These controls are designed to help organisations preserve evidence quality and explain the investigation process clearly.

10. Retention and deletion

Customer investigation data is retained under the applicable customer agreement and engagement arrangements. Verified written deletion instructions are handled through ScoopVault support; available product controls must not be assumed to remove every active and backup copy immediately.

Encrypted backups use a configured 14-day rotation. The time at which a deleted active-system item ceases to appear in backup copies depends on that rotation and the applicable retention obligations. Customers may submit a verified written deletion instruction by contacting privacy@scoopvault.io.

11. Third-party providers and subprocessors

ScoopVault uses selected third-party providers to deliver core platform functionality. Data shared with these providers is limited to what is necessary to provide the requested service function.

ScoopVault will notify affected customers of material subprocessor changes where required by law, contract, or applicable customer agreement.

Anthropic is the publisher/licensor of the Claude models used for AI-assisted analysis. Anthropic is not a subprocessor for this Service: under the approved Google Cloud managed route, prompts and responses submitted for AI-assisted analysis are not shared with Anthropic, and Anthropic does not receive investigation content, prompts or outputs directly.

12. Incident response

If ScoopVault becomes aware of a suspected security incident affecting customer data, we will investigate promptly and notify affected customers without undue delay where required by law or contract. We will provide information reasonably available to help affected customers assess, mitigate, and meet their own notification obligations.

Security concerns or suspected incidents should be reported to security@scoopvault.io.

13. Compliance roadmap

ScoopVault is being developed with enterprise security, auditability, and data protection expectations in mind. As the product matures, we expect to pursue industry-standard certifications, independent assessments, and additional customer-facing security documentation.

Current priorities include an independent penetration test ahead of general availability, formalised data processing documentation, evidenced restore validation for the backup process, and expanded customer security review materials.

14. Contact

ScoopVault is operated by Certisyt Group Ltd. For security questions or suspected incidents, contact security@scoopvault.io.

For privacy questions or deletion requests, contact privacy@scoopvault.io.

For legal or terms-related questions, contact legal@scoopvault.io.