Security, privacy, and defensibility for Google Workspace investigations

1. Platform security model

ScoopVault is a multi-tenant investigation platform for Google Workspace data. Each customer organisation is logically isolated by tenant ID at the application and database layer. Users can only access the matters, jobs, exports, findings, reports, and audit records associated with their assigned tenant and authorised role.

Tenant isolation is enforced by backend role and tenant checks, not only by frontend user interface restrictions. This ensures that access controls remain in place even if a user attempts to call application APIs directly.

2. Hosting and infrastructure

ScoopVault production services are hosted on Google Cloud Platform in the London region (europe-west2, United Kingdom), with encrypted backups replicated to independent object storage operated by Hetzner in Finland (EU). The platform uses separate application, database, cache, queue, and storage components to support investigation processing, auditability, exports, and service reliability.

The private key required to decrypt backups is held offline and is never stored on any server.

3. Authentication and session security

ScoopVault uses Google OAuth for authentication. ScoopVault does not store or manage customer passwords. Users authenticate through Google, and ScoopVault issues time-limited application sessions after successful authentication and authorisation.

• Google OAuth-only authentication
• Session duration of 60 minutes
• Sensitive administrative actions require a fresh session under 30 minutes old
• Logout invalidates sessions server-side using a Redis denylist
• Redis failure is treated conservatively for session validation
• Role-based access is enforced server-side

4. Roles and access boundaries

ScoopVault uses role-based permissions to separate platform administration from customer investigation activity.

5. Google Workspace access

ScoopVault accesses Google Workspace data only through OAuth permissions granted by an authorised customer organisation. The platform requests the minimum Google permissions required to provide investigation, export, account identity, and evidence management functionality.

ScoopVault does not request any Gmail or Google Drive scopes. Email evidence enters the platform exclusively as point-in-time Google Vault exports; the platform never reads live mailboxes or Drive files, sends email through customer accounts, or alters customer data in Google Workspace.

ScoopVault currently uses customer-authorised OAuth for Google Workspace access. Domain-wide delegation may be offered as a future enterprise deployment option for customers that prefer administrator-managed access.

6. Google API Limited Use

ScoopVault's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Workspace data obtained through Google APIs is used only to provide user-facing eDiscovery, investigation, reporting, evidence management, and audit functionality requested by the authorised customer organisation.

ScoopVault does not use Google Workspace data obtained through Google APIs for advertising, unrelated analytics, user profiling, sale to third parties, or training general-purpose AI models.

7. Data processed by ScoopVault

Depending on the customer's configuration and investigation activity, ScoopVault may process the following categories of data:

• Google Vault matters, searches, exports, and related metadata
• Email messages from Vault exports: headers, recipients, subjects, timestamps, body content, and attachments
• MBOX and EML exports generated from authorised Vault searches
• Investigation matters, job names, search criteria, and query metadata
• AI-generated summaries, findings, cases, timelines, risk indicators, and reports
• Chain of custody records and integrity verification data
• Audit logs, user actions, authentication events, and administrative events
• User account metadata, including name, work email address, role, and tenant assignment

8. AI-assisted analysis

AI-assisted analysis is not enabled by default. Where it is enabled for an authorised tenant, ScoopVault accesses Claude models through Google Cloud (Vertex AI) to support investigation workflows such as summarisation, risk identification, timeline generation, clustering, question answering, and report drafting. Google provides the managed AI inference service; Anthropic is the publisher/licensor of the Claude models and, under this approved route, does not receive investigation content, prompts or outputs directly. Exact and Connected search do not use an AI model. AI analysis is used to assist human review, not to replace legal or compliance judgement.

When AI analysis is run, relevant excerpts, metadata, summaries, and documents may be sent to the AI provider solely to generate the requested investigation output.

Customer data is not used to train third-party AI models. ScoopVault does not permit customer investigation data, Google Workspace content, prompts, outputs, summaries, reports, or exports to be used for third-party AI model training, except where expressly agreed in writing by the customer.

AI findings are advisory only. Raw emails, exported records, chain of custody PDFs, cryptographic integrity checks, and audit logs are the defensible artefacts that customers should rely on for legal, regulatory, employment, or compliance decisions.

9. Evidence defensibility and auditability

ScoopVault is built around auditable investigation workflows. The platform records key actions so that customers can understand who did what, when, and in relation to which matter or job.

• Login and logout events
• Matter creation and investigation setup
• Search jobs and export activity
• AI analysis runs and generated findings
• Evidence flagging and review actions
• Report generation and evidence downloads
• Administrative changes
• Team invitations and invite lifecycle actions

ScoopVault supports chain of custody PDFs, cryptographic hashes, integrity verification, and audit log CSV exports. These controls are designed to help organisations preserve evidence quality and explain the investigation process clearly.

10. Retention and deletion

Customer investigation data is retained while the customer account remains active unless deleted earlier by the customer or by verified request. Following account termination, ScoopVault may retain customer investigation data for up to 30 days to support transition, recovery, legal hold, compliance, dispute resolution, and audit requirements.

After this period, customer investigation data is deleted or anonymised from active production systems unless continued retention is required by law, contract, security investigation, dispute, or legitimate audit obligation.

Database backups are retained for 14 days. Deletion from backups follows the normal backup rotation cycle. Customers may request deletion by contacting privacy@scoopvault.io.

11. Third-party providers and subprocessors

ScoopVault uses selected third-party providers to deliver core platform functionality. Data shared with these providers is limited to what is necessary to provide the requested service function.

ScoopVault will notify affected customers of material subprocessor changes where required by law, contract, or applicable customer agreement.

Anthropic is the publisher/licensor of the Claude models used for AI-assisted analysis, where and when that capability is enabled. Anthropic is not a subprocessor for this Service: under the approved Google Cloud managed route, prompts and responses submitted for AI-assisted analysis are not shared with Anthropic, and Anthropic does not receive investigation content, prompts or outputs directly.

12. Incident response

If ScoopVault becomes aware of a suspected security incident affecting customer data, we will investigate promptly and notify affected customers without undue delay where required by law or contract. We will provide information reasonably available to help affected customers assess, mitigate, and meet their own notification obligations.

Security concerns or suspected incidents should be reported to security@scoopvault.io.

13. Compliance roadmap

ScoopVault is being developed with enterprise security, auditability, and data protection expectations in mind. As the product matures, we expect to pursue industry-standard certifications, independent assessments, and additional customer-facing security documentation.

Current priorities include an independent penetration test ahead of general availability, formalised data processing documentation, continued backup and restore validation, and expanded customer security review materials.

14. Contact

ScoopVault is operated by Certisyt Group Ltd. For security questions or suspected incidents, contact security@scoopvault.io.

For privacy questions or deletion requests, contact privacy@scoopvault.io.

For legal or terms-related questions, contact legal@scoopvault.io.