Technical and Organizational Measures

VidScore LLC is a small US-based company (Massachusetts). This document is written to be honest about that scale. It describes the controls VidScore actually implements today, the controls VidScore inherits from sub-processors, and the controls that are not currently implemented.

Framework alignment

VidScore's control framework is designed with reference to NIST SP 800-53 Rev. 5 control families and ISO/IEC 27001:2022 Annex A. VidScore is not certified against either framework. The frameworks are used as design references, not compliance claims. VidScore is developing its security program and may pursue third-party attestation (such as SOC 2 Type II) when operationally appropriate. No public timeline is committed to.

Inherited controls

Several categories of controls in this document are provided at the infrastructure layer by VidScore's sub-processors. Where this is the case, the relevant section names the specific sub-processor and links to its published security program. Sub-processor certifications apply only to the services each sub-processor provides; they do not extend to VidScore's own operations, code, or data handling practices above the infrastructure layer.

Scope of this document

This document applies to the VidScore platform (vidscore.ai), the VidScore Chrome extension, the VidScore Enterprise Data product, and the enterprise customer portal. It does not apply to third-party applications or websites that integrate with or reference VidScore data.

VidScore implements the following access controls at the application layer:

• Role-based access control in the enterprise customer portal, with two roles (administrator and member) enforced at both the application and database layers via Supabase row-level security (RLS)
• A last-administrator safeguard that prevents an enterprise organization from ending up without any administrator, protecting customers from self-lockout
• Service-role database keys held only in Vercel environment variables and a single operator password manager, never committed to source control
• Anon keys scoped to public read-only operations on published entities; no service-role access from client code
• Session tokens issued by Supabase Auth with short refresh windows for consumer sessions and a 30-day bearer token for enterprise portal sessions

VidScore does not currently implement a formal Zero Trust Model architecture or a separate identity provider for internal access. Internal operations rely on direct Supabase dashboard access and Vercel dashboard access protected by each vendor's native MFA. Customer-facing SSO is available for Scale tier enterprise customers (see Section 8).

VidScore does not currently implement a formal recurring security awareness training program. All current contributors operate under written confidentiality terms and perform informal security review at onboarding. VidScore will implement formal training as the team grows.

VidScore maintains the following audit and accountability controls:

• An append-only activity log for the enterprise customer portal that records every significant action (sign-in, download, invite, role change, settings change) with the actor, action, target, request IP address, user agent, and action metadata. Retained for 365 days per organization
• A separate append-only trust and safety audit log for content safety decisions, IP blocks, and rate limit events
• Database-level query logs provided by Supabase
• Edge request logs provided by Vercel and Cloudflare for the front-end surface
• Stripe webhook event logs for every billing-related action

Enterprise customer administrators may export their organization's activity log to CSV at any time directly from the portal. See the Privacy Policy Section 11 for retention details.

VidScore performs informal self-review of its controls against the structure of this document at least once per version bump. VidScore does not currently engage a formal external assessor, maintain a public bug bounty program, or publish penetration test reports.

Security vulnerability reports may be submitted to [email protected] under the process documented in the Security Policy.

VidScore maintains configuration management through the following practices:

• All infrastructure is managed as code: Supabase migrations in the vidscore-chrome/supabase/migrations directory, Vercel project configuration in the repository
• All changes to production land through git commits with a pull request model; no out-of-band configuration changes to production
• Environment variables and secrets are stored in Vercel encrypted environment storage and Supabase Vault, never committed to source control
• Database changes are tracked in version-controlled migration files with an immutable ordering convention (YYYYMMDD prefix)

VidScore does not currently operate a formal change advisory board (CAB) or require multi-party approval for production deployments. Emergency changes are documented in commit messages.

Contingency controls are inherited from sub-processors at the infrastructure layer:

• Database point-in-time recovery (PITR) and automated daily backups are provided by Supabase as part of VidScore's plan
• Edge delivery is provided by Vercel with immutable deployments that enable instant rollback to any previous production version
• DDoS mitigation and edge resilience are provided by Cloudflare

VidScore does not currently maintain a formal Business Continuity Plan (BCP) or Disaster Recovery (DR) runbook beyond the inherited controls above. VidScore has no on-premise infrastructure or office-resident data. All Customer data resides with Supabase under Supabase's SOC 2 Type II program; VidScore itself is not SOC 2 certified.

VidScore's identification and authentication controls include:

• Enterprise customer portal uses email-based one-time passcode (OTP) authentication via Supabase Auth by default. Passwords are not used
• SAML 2.0 single sign-on (SSO) is available for Scale tier enterprise customers and is processed by Supabase Auth. When a Scale customer configures SSO for a verified email domain, sign-in attempts from that domain are redirected to the customer's identity provider (Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud, or any SAML 2.0 compliant IdP) and authorization still requires an explicit portal membership invitation
• Consumer website authentication uses Supabase Auth with email and Google OAuth providers
• MFA is enforced on all administrator accounts for VidScore's vendor dashboards (Supabase, Vercel, Cloudflare, Stripe, GitHub)
• Session tokens for the enterprise portal are stored in browser localStorage and expire after 30 days, after which a fresh OTP or SSO sign-in is required

SSO provider metadata (email domain, identity provider selection, display name, request timestamps, and the Supabase SAML provider identifier) is stored in the sso_providers table. SSO configuration events and successful SSO sign-ins are recorded in the audit log for the enterprise organization.

VidScore's incident response obligations to enterprise customers are documented in Section 8 of the Data Processing Agreement, including a commitment to notify Customer of any personal data breach without undue delay and no later than 72 hours after becoming aware.

Security vulnerabilities can be reported to [email protected]. VidScore acknowledges reports within 2 business days, triages within 5 business days, and provides regular updates on remediation progress per the published Security Policy.

VidScore does not currently operate a 24/7 security operations center or a dedicated on-call incident response team. Incident response is handled by the operational team on a best-effort basis within business hours plus the 72-hour notification window for any personal data breach.

VidScore operates no physical hardware. All maintenance of underlying compute, storage, and network infrastructure is performed by sub-processors (Supabase, Vercel, Cloudflare, Upstash). Each of those sub-processors maintains third-party attestations for its own services; see the Sub-processors page for details.

VidScore does not handle physical media. Data-at-rest controls are:

• Customer data at rest in the primary database is encrypted using AES-256 at the storage layer by Supabase
• Cached data in Upstash Redis is encrypted at rest by Upstash
• File storage (delivery files for the Enterprise Data product) is encrypted at rest by Supabase Storage (backed by AWS S3)
• No removable media is used in the VidScore operational workflow
• Decommissioned storage is sanitized by the underlying cloud providers (Supabase, Upstash) in accordance with industry-standard media sanitization practices

VidScore has no offices, data centers, or on-premise infrastructure. All physical and environmental protection is inherited from sub-processors:

• Supabase: database infrastructure hosted in Amazon Web Services (AWS) data centers under AWS physical security controls
• Vercel: edge and serverless compute distributed across Vercel's global edge network
• Cloudflare: CDN and DNS distributed across Cloudflare's global edge points of presence
• Stripe: payment processing infrastructure in Stripe-managed and AWS data centers

VidScore has no ability to inspect or audit the physical controls of these sub-processors directly. VidScore relies on each sub-processor's published attestations (SOC 2 Type II, ISO 27001, or equivalent) for physical security assurance.

This document serves as VidScore's System Security Plan. It is reviewed and updated at each version bump or material change to VidScore's control posture. The next scheduled review is 180 days after the effective date at the top of this page.

Security program ownership rests with the VidScore operational team. VidScore does not currently have a dedicated Chief Information Security Officer (CISO) or a dedicated security staff separate from engineering. Security decisions are made by the operational team with reference to the frameworks identified in Section 1.

VidScore's personnel security controls:

• All contributors, including employees and independent contractors, execute written confidentiality terms before accessing production systems or Customer data
• Access revocation is performed within 24 hours of termination or role change via password manager rotation and vendor dashboard role removal
• Production access is limited to the minimum personnel required to operate the Services

VidScore does not currently perform formal pre-hire background checks on contributors. Background checks may be introduced as the team grows and as contractual requirements warrant.

Personal data processing is governed by the VidScore Privacy Policy and, for enterprise customers, the Data Processing Agreement. These documents describe the categories of personal data collected, the legal bases for processing, retention periods, international transfer mechanisms, and data subject rights under the GDPR and CCPA.

Data subject access, correction, and deletion requests may be submitted to [email protected]. VidScore has not designated a Data Protection Officer (DPO) because VidScore is not required to do so under GDPR Article 37 at the current scale of processing.

VidScore maintains an informal risk register reviewed at each version bump of this document. VidScore does not currently apply a formal quantitative risk scoring framework. Risk assessment is qualitative and is performed by the operational team with reference to the frameworks in Section 1 and the sub-processor inventory on the Sub-processors page.

VidScore's software development lifecycle (SDLC) controls:

• All production code changes land through git commits; no direct production edits
• A type-checking gate (TypeScript strict mode) runs on the web application before deployment
• Third-party dependencies are scanned for known vulnerabilities via GitHub Dependabot alerts, reviewed on a best-effort basis
• Database migrations are version-controlled and applied in forward order
• Vendor selection for new sub-processors requires a public SOC 2, ISO 27001, or equivalent attestation before onboarding

VidScore does not currently implement a formal peer review requirement for every production commit. Code review is performed on a best-effort basis for changes with broad impact.

VidScore's system and communications protection controls:

• All data in transit is encrypted using Transport Layer Security (TLS) 1.2 or higher, enforced by Cloudflare and Vercel at the edge
• HTTP Strict Transport Security (HSTS) is enforced on all vidscore.ai origins
• Customer data at rest is encrypted using AES-256 via Supabase (backed by AWS)
• Rate limiting is applied at the Vercel middleware layer and the Cloudflare edge to mitigate abuse
• DDoS protection is inherited from Cloudflare

VidScore's system integrity controls:

• GitHub Dependabot monitors third-party package dependencies and surfaces known vulnerabilities
• Sentry (or equivalent error monitoring) captures production errors for review
• Supabase row-level security (RLS) enforces logical data isolation between customer organizations at the database layer
• The enterprise portal activity log and the trust and safety audit log are append-only and cannot be modified or deleted from any client context

VidScore does not currently operate a Web Application Firewall (WAF) with custom rules beyond Cloudflare's default protections. VidScore does not currently run anti-malware scanning on application infrastructure; all compute runs on managed sub-processor infrastructure that runs such scanning at its own layer.

VidScore maintains the current list of sub-processors on the Sub-processors page. Every sub-processor listed there is vetted for a current public SOC 2 Type II attestation, ISO 27001 certification, or equivalent before onboarding. Changes to the sub-processor list are published on that page at least 30 days before the change takes effect, per the notification process described on the Sub-processors page and in the Data Processing Agreement.

VidScore does not currently operate a formal third-party risk management (TPRM) program beyond the attestation review and public-posture review performed at onboarding and at each sub-processor change.