Security
Security at Scotty.
This page is written for the person doing the review, not for a marketing audience. If something you need isn't here, ask and we'll answer directly.
Where we stand.
Two things are not available today, stated here rather than left for you to discover during a review.
- No SSO, SAML, or SCIM.
Accounts are created and managed directly.
- No contractual uptime SLA.
We will not put a number in a contract that we cannot yet stand behind with operating history.
How your bank data moves.
Bank and card connections are established through Plaid. Credentials are held by Plaid, not by Scotty.
Stored access tokens are encrypted at rest, and every inbound webhook is signature-verified before it is processed.
You authenticate directly with your institution.
Your banking username and password stop here. Scotty never sees them.
Transactions, and an access token encrypted at rest. Webhooks are signature-verified before processing.
Nothing travels back the other way. The connection reads transactions so they can be categorized and reconciled. There is no payment capability anywhere in the software, so there is no mechanism for money to move along this path.
One company's data cannot reach another.
Every request resolves an organization context before any data is read. If that resolution fails, access is denied rather than falling back to a default.
That behavior is covered by an automated test that runs on every build, so a regression fails the build rather than reaching production.
Agent action boundaries.
Agents operate only inside the organization context of the signed-in user and cannot cross it. Three further boundaries are architectural rather than configurable.
- 01It cannot move money.
Bills are remind-only. Scotty will tell you a payment is due and draft the reminder. It has no ability to pay anything.
- 02It cannot send on its own.
Emails, texts, invoices and signature requests are all drafted and then held. You send them.
- 03It cannot change your login.
No agent in this system is permitted to create, reset or rotate a credential without a named human confirming it. That’s a written policy, not a preference.
No agent changes a login.
No agent, tool, or automated process may create, reset, rotate, replace, or disable a credential without explicit, current confirmation from a named authorized human for that exact account and action.
A failed login, a suspected exposure, or a security concern does not create an exception. The workflow is stopped and reported instead.
Who else touches the data.
- PlaidBank and card connections
- StripePayments
- SupabaseData storage and authentication
- Email, telephonyDelivery of the messages Scotty drafts on your behalf
A current list is available on request.