Security and trust
Scolah Compass Platform installs software on servers you own. This page explains the limits we built in, so your IT and security teams can review it.
The agent only connects out
Section titled “The agent only connects out”The agent on each server starts every connection itself, over HTTPS, to the platform. The platform can’t open a connection into your network, and connecting a server doesn’t require opening any inbound port. Inbound ports 80 and 443 are only needed if you give an installation a public web address.
Each server has its own identity
Section titled “Each server has its own identity”When a server enrolls, its agent creates its own signing and encryption keys, and only the public halves are sent to the platform. The one-time enrollment token is stored only as a hash and can’t be reused. Every request the agent makes afterwards is signed with the server’s key.
Only signed software runs
Section titled “Only signed software runs”Applications arrive as bundles: fixed, versioned sets of files and pinned container images. Scolah signs every bundle. Before deploying, the agent checks the signature and the fingerprint of every file, and refuses a bundle with any file changed, missing or added. Published versions are never edited; a fix is always a new version.
Bundles only describe what to run. They can’t carry scripts for the agent to execute on your server. Any setup work, such as creating a read-only database user for a connection, is done by code built into the agent itself.
Secrets are sealed for one server
Section titled “Secrets are sealed for one server”Passwords and keys an installation needs, whether generated by the platform or entered by you, are encrypted for that installation’s server and only decrypted there. They’re shown in the portal at most once, when first created, and you can’t read them back afterwards.
Connections get their own limited accounts
Section titled “Connections get their own limited accounts”When one installation reads another’s data, the platform creates a separate read-only account for that one connection. Tables holding passwords, tokens and keys are left out. Admin credentials you register for an external service are only used to create those limited accounts, never handed to an application. Disconnecting deletes the account.
You stay in control
Section titled “You stay in control”- Block a server to cut off its agent immediately. Applications already running on it keep running.
- Every privileged action is recorded in the Activity log.
- Your application data lives on your servers. The platform stores configuration, status reports and usage, not your applications’ records.
- Turn on two-factor authentication for everyone with portal access.
More detail
Section titled “More detail”The Scolah Trust Centre has the full picture for security and data-protection reviews. It covers an architecture and data-flow diagram, exactly what leaves your servers, the threat model and incident response. Our Data Processing Addendum and subprocessor list are also there. To report a vulnerability, see our disclosure policy.