How SimplyScan Protects Your Data: SOC 2 Compliant Processes

Quick answer: SimplyScan runs on SOC 2 Type 2, ISO 27001, and GDPR certified infrastructure. Your scan data is protected by AES-256 encryption at rest, TLS 1.3 in transit, and database-level Row-Level Security (RLS). For Pro scans, source code is processed in memory and never stored on disk.

By Gabriel CA · Kraftwire Software

2026-02-21 · 10 min read

Why Your Security Scanner Must Be Secure

When you use a security scanner to audit your application, you are sharing sensitive technical details: your deployment URLs, your site's architecture, and potentially your source code. If the scanner itself is insecure, it becomes a high-value target for attackers looking for a roadmap to your vulnerabilities. A scan report is essentially a list of ways to break into an application. That is why we treat your data with the same rigor required by global compliance frameworks.

SimplyScan is built on infrastructure that holds SOC 2 Type 2, ISO 27001, and GDPR certifications. Your scan data is protected by AES-256 encryption at rest, TLS 1.3 in transit, and database-level Row-Level Security (RLS). For Pro scans, source code is processed in memory and never stored on disk.

Understanding the Certifications

SimplyScan is built on infrastructure that holds the following certifications. It is important to note that these certifications are held by our infrastructure providers (such as Supabase, AWS, and Vercel), not by Kraftwire Software directly. We inherit the physical and environmental security controls of these world-class providers.

SOC 2 Type 2

The SOC 2 (Service Organization Control 2) Type 2 is an auditing standard developed by the American Institute of CPAs (AICPA). It is specifically designed for service providers storing customer data in the cloud.

Type 1 vs. Type 2: A Type 1 report is a snapshot of security controls at a single point in time. A Type 2 report is much more rigorous, evaluating how those controls perform over a period of 6 to 12 months.
The Five Criteria: SOC 2 evaluates five "Trust Services Criteria": Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only mandatory criterion for every audit.

ISO 27001

ISO 27001 is the international gold standard for Information Security Management Systems (ISMS). Our providers undergo annual audits to ensure they meet these 93 specific security controls. This framework ensures a systematic approach to managing sensitive company information so that it remains secure. It includes people, processes, and IT systems by applying a risk management process.

GDPR Compliance

The General Data Protection Regulation (GDPR) protects the privacy of EU residents. Our infrastructure is GDPR-compliant by design, meaning we have the necessary Data Processing Agreements (DPAs) and technical measures in place to handle personal data legally and safely. We minimize data collection to only what is necessary for the scan and provide tools for users to manage their data footprint.

Technical Safeguards for Your Scan Data

Encryption at Rest: AES-256

Every piece of data stored by SimplyScan · including your scan scores, identified vulnerabilities, and account details · is encrypted using AES-256. This is a symmetric-key encryption standard that has never been broken by brute force. Even if an attacker gained physical access to the underlying storage disks, the data would remain an unreadable cipher. AES-256 is the same encryption standard used by governments and military organizations worldwide to protect top-secret information. We recommend checking your own site's encryption using our SSL checker.

Encryption in Transit: TLS 1.3

Data moving between your browser and our servers, or between our scanning engine and your application, is protected by TLS 1.3. This is the latest and most secure version of the Transport Layer Security protocol. It eliminates legacy cryptographic algorithms and provides "Forward Secrecy," meaning that even if a session key is compromised in the future, it cannot be used to decrypt past communications.

Row-Level Security (RLS)

One of the most critical questions we get is: "Can another user see my scan results?" The answer is no, thanks to Row-Level Security (RLS).

RLS is a database-level authorization layer. Instead of relying solely on application code to "filter" data, the database itself checks the identity of the user for every single row of data requested. If the user_id on the row doesn't match the user_id of the requester, the database refuses to return the data. This prevents "Insecure Direct Object Reference" (IDOR) attacks, which are a common form of broken access control. By implementing RLS at the database level, we ensure that even a bug in our frontend code cannot leak one user's data to another.

Source Code Handling in Pro Scans

For users performing a GitHub repository scan, security is even tighter:

In-Memory Processing: We fetch your source code only for the duration of the scan.
No Persistent Storage: Your code is processed in volatile memory (RAM) and is never written to a permanent disk or database.
Immediate Deletion: Once the analysis engine finishes, the memory is cleared. We only store the resulting "findings" (e.g., "Line 42 has an exposed API key"), never the code itself.
Scoped Permissions: When you connect GitHub, we request the minimum permissions necessary to read the code for analysis.

Applying SOC 2 Principles to Your AI-Built App

While SimplyScan provides the tools to find technical bugs, SOC 2 compliance also involves operational processes. Many of these issues stem from a lack of "Security by Design." If you are building with tools like Lovable, Bolt.new, or Cursor, you should adopt these SOC 2-aligned practices to protect your own users.

1. Access Control and MFA

SOC 2 requires strict control over who can access production environments.

Multi-Factor Authentication (MFA): Ensure MFA is enabled for your GitHub, Supabase, and Vercel accounts. This is the single most effective way to prevent account takeover.
Least Privilege: Don't give "Owner" or "Admin" roles to every team member. Use role-based access control (RBAC) to ensure people only have the access they need to do their jobs.
Audit Logs: Keep track of who accessed what and when. Most modern cloud providers offer audit logs that can be reviewed during a security incident.

2. Database Isolation

Just as SimplyScan uses RLS to protect your scan data, you must use it to protect your users. In many vibe-coded apps, developers forget to enable RLS on Supabase or Firebase, leaving the entire database open to anyone with the "anon" API key. This is a critical vulnerability that can lead to massive data breaches. We provide a Supabase security checklist to help you fix this and ensure that users can only access their own data.

3. Secure Third-Party Integrations

Your app is only as secure as its weakest integration. SOC 2 auditors look at how you handle API keys and secrets.

Never hardcode API keys in your frontend code where they can be scraped by anyone.
Use environment variables and secret management tools provided by your hosting platform.
Verify webhook signatures for services like Stripe or Clerk to ensure the requests are actually coming from the provider.
Regularly rotate your API keys and secrets to minimize the impact of a potential leak.

Performance as a Security Signal

There is a strong correlation between app performance and security. While speed is often discussed in terms of SEO or revenue · and indeed, speed equals revenue · it is also a signal of code quality.

Bloated, unoptimized apps often contain outdated libraries with known vulnerabilities (CVEs). A fast, lean app is easier to audit and less likely to have a massive attack surface. Our speed optimization guide explains how to clean up AI-generated code for better performance and security. High latency can also be a symptom of an ongoing Layer 7 DDoS attack or resource exhaustion, making performance monitoring a vital part of your security stack.

Answer Engine Optimization (AEO) and Security

As AI engines like Perplexity and ChatGPT become the primary way users find apps, Answer Engine Optimization (AEO) is becoming as important as SEO. However, AI bots are sensitive to security signals. If your site has a poor security reputation, lacks proper security headers, or is frequently flagged for malware, AI agents may flag your site as "untrustworthy" and refuse to recommend it to users.

SimplyScan's free scan includes an AI visibility check to see if your site is properly configured for these new generative engines. Ensuring your site is secure and follows best practices is the first step in ranking well in AI-driven search. AI models prioritize safe, reliable sources, so a secure site is a visible site.

Uptime and Availability

The "Availability" pillar of SOC 2 ensures that your service is there when users need it. SimplyScan offers uptime monitoring and status pages to help you track this. If your app goes down, it's not just a convenience issue · it can be a security indicator of a Denial of Service (DoS) attack or a failing infrastructure component.

Maintaining high availability requires redundant systems and proactive monitoring. By using a status page, you build trust with your users by being transparent about incidents and maintenance windows. This transparency is a core value of the SOC 2 framework, specifically under the "Communication" and "Monitoring" criteria.

Summary of Data Protection Measures

SimplyScan implements a multi-layered defense strategy to ensure your data remains confidential and integral.

Data at Rest: Protected by AES-256 Encryption, the industry standard for securing sensitive information on physical storage.
Data in Transit: Secured via TLS 1.3, ensuring that all communications between the user and our servers are encrypted and tamper-proof.
User Isolation: Enforced by Row-Level Security (RLS) at the database level, preventing unauthorized access to data across different accounts.
Source Code: Handled via in-memory processing for Pro scans. Code is never written to disk and is discarded immediately after analysis.
Infrastructure: Hosted on providers with SOC 2 Type 2 and ISO 27001 certifications, ensuring physical and environmental security.
Payments: Processed through Stripe, a PCI-DSS Level 1 service provider, meaning we never handle or store your credit card details directly.
Access Control: Internal access to production systems is strictly limited and requires Multi-Factor Authentication (MFA).

Conclusion

Security is not a one-time event; it is a continuous process of monitoring and improvement. SimplyScan was built to provide that continuous oversight for the new generation of AI-built applications. By building on SOC 2 Type 2 infrastructure and implementing strict technical controls like RLS and AES-256 encryption, we ensure that your path to a secure app is itself secure.

Our commitment to security extends beyond our own platform. We aim to empower developers to build more secure applications by providing the tools and knowledge necessary to navigate the complex landscape of modern web security. Whether you are building a small side project or a large-scale enterprise application, the principles of SOC 2 can help you build a more resilient and trustworthy product.

If you haven't audited your application recently, you can run a free scan in 30 seconds to check your security, speed, and AI visibility. Our scan grades 8 dimensions in one pass, providing you with a comprehensive overview of your site's health without requiring a signup.

Frequently asked questions

What is the difference between SOC 2 Type 1 and Type 2?

SOC 2 Type 1 evaluates a company's security controls at a single point in time, essentially a snapshot. Type 2 audits how those controls operate over an extended period, typically 6 to 12 months, so it proves consistent practice rather than one good day. That is why Type 2 is considered the stronger attestation and why SimplyScan builds exclusively on Type 2 certified infrastructure.

Does SimplyScan store my source code after a scan?

No. Pro scans that analyze a GitHub repository fetch your source files during the scan, process them in memory, and discard them when analysis completes. Source code never touches persistent storage; only the scan findings and metadata are retained. Free URL-based scans never access source code at all, only the publicly served HTML, JavaScript, and headers any visitor can see.

Is AES-256 encryption secure enough for sensitive data?

Yes. AES-256 is the same encryption standard used by governments and military organizations worldwide, and no practical attack against it exists. SimplyScan uses AES-256 for all stored data and TLS 1.3, the latest Transport Layer Security version with forward secrecy by default, for everything in transit, so scan data is protected throughout its lifecycle.

Is SimplyScan GDPR compliant for EU users?

Yes. SimplyScan runs on infrastructure that is GDPR-compliant by design, with data processing agreements, appropriate technical measures, and documented data handling procedures. Data retention policies are enforced, scan data is kept only as long as needed, and users can request deletion of their data at any time, in line with GDPR rights for EU residents.

Can a free URL scan see my private code or data?

No. A free scan analyzes only the publicly served output of your application: the HTML, JavaScript bundles, HTTP headers, and configuration files that any visitor to your URL can already see. It does not access private code, databases, or credentials. Only the resulting findings, score, and summary are stored, associated with the scan ID.

Do I need SOC 2 certification for my own app?

Only when customers require it, typically enterprise buyers who demand a SOC 2 report before signing. Certification audits the whole company, including operational security like background checks, device encryption, and incident response, not just code. Most indie and early-stage apps instead adopt SOC 2 principles as best practices: MFA everywhere, role-based access, RLS on user data, and documented incident procedures.