ScopeFS

Security

There is a line, and nothing crosses it backwards.

Your storage credentials stay on this side. Your app gets a key that opens one space. It cannot get the rest.

ScopeFS holds

  • The credentials that reach your storage
  • The secret used to sign what it hands out
  • The keys themselves
  • Signed-in admin sessions

Your app can reach

  • Keys
  • And nothing that reaches the building

An administrator of this service can reach the side that matters. That is deliberate: an operator who cannot reach your storage credentials cannot run your service. You should know it.

What a key can and can’t reach

A keyThe one space it was made for, at the permission it was given.
A key, after being taken backNothing, anywhere, immediately.
A key, leakedOne space, one permission level, until you take it back.
Your appThe key. Never the storage credentials.
An admin of this serviceThe storage credentials — and this is deliberate.

The life of a key

Made.You choose the space and what it can do. You see it once, and it is never shown again.
In use.Someone uses it, and you get a line saying which key, what it did, and whether it worked.
Taken back.One action. It stops working everywhere at once, including mid-run, and stays in your records as history.

Taking a key back is the only routine security task this product exists to make possible, and it should be the easiest thing you do all week.

What we write down

Every use of a key and whether it worked, every key made, changed or taken back, and every console sign-in, successful or not. We keep these to run the service and investigate misuse.

2026-09-28T14:02:11Z key=inv-ro-01 action=GET object=report.pdf result=ok

We never open, index, or analyse the contents of your files — not for search, not for scanning, not for anything else. Nothing in the service has a reason to. To be precise: if you use the S3 endpoint, the bytes of a file do pass through ScopeFS on the way to you. They are relayed, not examined or kept.

Who runs this

People get in by invitation only, through a single sign-on provider. Two roles: an owner changes spaces, an admin changes keys. Every administrative action is recorded against the person who took it.

If you find something

A dedicated security address, separate from support, is not yet published. An unmonitored disclosure address invites disclosure to nowhere. No compliance badges appear here — a certification in progress belongs on a roadmap.

How a key behaves → Report something →