Procurement package.

AES-256 at rest. TLS 1.2 minimum, TLS 1.3 preferred in transit. AES-GCM-256 for authenticated encryption of session material and cryptographic state. Customer-managed encryption keys (BYOK) via AWS KMS available on the Enterprise tier.

Subprocessors are listed in the Subprocessors List Snapshot document included in the procurement package, with role, region, and data accessed for each. Customers receive 30 days advance notice of new subprocessors via the DPA-designated channel, with the right to object.

24 hours from confirmed incident, in writing to the customer's designated security contact. The 24-hour commitment is written into the standard DPA. Notification includes scope, affected data categories, containment status, and forensic timeline.

Okta, Microsoft Entra ID, Ping Identity, Auth0, OneLogin, Google Workspace, and ADFS. Standard SAML 2.0, OIDC, and OAuth 2.0 federation. SCIM 2.0 for user lifecycle. Custom IdP integrations available on the Enterprise tier.

SOC 2 Type II current. NIST SP 800-63-4 AAL3 alignment. Third-party penetration test executive summary and supporting attestation documents included in the procurement package per the package contents above. For specific certification requirements not listed, contact security@scrambleid.com.

ScrambleID is not in HIPAA scope and does not act as a Business Associate. The platform does not process protected health information (PHI). Authentication events processed by ScrambleID contain only identity verification material (cryptographic proof of authentication), with no associated health information.

Healthcare organizations using ScrambleID to authenticate users or workforce members can deploy the platform without bringing it into HIPAA scope, because no PHI flows through ScrambleID. For procurement form purposes, ScrambleID can be marked "not applicable" or "out of scope" for HIPAA. No BAA is required.

ScrambleID is not in PCI DSS scope. The platform does not process, store, or transmit cardholder data (CHD) or sensitive authentication data (SAD) as defined by the PCI Security Standards Council. Authentication tokens issued by ScrambleID are not in PCI scope.

Customers processing card payments may use ScrambleID to authenticate access to systems where cardholder data resides; cardholder data itself does not flow through ScrambleID. For procurement form purposes, ScrambleID can be marked "not applicable" for PCI DSS.

ScrambleID is not a financial institution under the Gramm-Leach-Bliley Act and does not collect or maintain consumer financial information or nonpublic personal information (NPI) as GLBA defines those terms.

Financial-services customers using ScrambleID for workforce or customer authentication retain their own GLBA obligations; the ScrambleID platform itself does not bring GLBA scope to the vendor relationship. For procurement form purposes, ScrambleID can be marked "not applicable" for GLBA. We support customers' Safeguards Rule documentation through the standard DPA terms and the artifacts in the procurement package.

FedRAMP: ScrambleID is commercial software and does not currently hold FedRAMP authorization. Federal agencies should contact us directly to discuss roadmap timing.

FERPA: Not applicable. ScrambleID does not process student education records and is not a "school official" under FERPA. Educational institutions using ScrambleID for authentication do not transmit education records through the platform.

SOX: Not directly applicable to ScrambleID. For SOX-relevant procurement reviews (controls over financial reporting systems), the SOC 2 Type II attestation is the standard third-party evidence of operational controls for a vendor in this role. The full report is included in the package.

Recovery time objective (RTO) and recovery point objective (RPO) targets stated in the BCP/DR Summary. Geographic redundancy across multiple AWS regions. Recovery testing performed quarterly with documented outcomes. Full BCP/DR Summary included in the procurement package.

12-month default MSA term with auto-renewal and 60-day non-renewal notice. Net 30 payment terms; Net 60 available for Enterprise. Multi-year prepay available with discount. Termination for material breach with 30-day cure period. Standard MSA, DPA, and SLA templates included in the procurement package.

99.95% monthly uptime commitment with tiered service credit structure for missed SLAs. Excludes scheduled maintenance with 7-day advance notice. Live status, current incidents, and historical uptime at status.scrambleid.com.

Self-service JSON export through the admin console. Full account export with audit logs and historical events available by request to privacy@scrambleid.com, delivered within 7 business days in JSON or CSV.

Data subject rights requests (access, correction, deletion, portability) processed within 30 calendar days with certificate of deletion provided. Backup retention is 35 days; data is cryptographically unrecoverable thereafter.

Yes. Custom security questionnaires are completed within 3 business days. Submit to security@scrambleid.com or include in the procurement package request.

Yes. Named customer references with reviewer permission, matched to industry segment, available on request. References are provided after a mutual NDA is in place. Contact procurement@scrambleid.com.

procurement@scrambleid.com with same-business-day response on weekdays, 9 AM to 6 PM Eastern. For technical questions during procurement, schedule a 30-minute call at calendly.com/scrambleid/30-minute-meet.