Information security

Security Policy

Effective August 3, 2026 · Version 1.0

This policy is issued by Terraforeman LLC, doing business as TerraForeman, and applies to the TerraForeman website, Scout application, company workspaces, subscriptions, and related services.

Security Commitment

Terraforeman LLC uses administrative, technical, and operational safeguards designed to protect customer information against unauthorized access, loss, misuse, alteration, and disclosure. No internet-connected service can promise absolute security. This policy describes a risk-based program, not a warranty that incidents will never occur.

Core Safeguards

• HTTPS/TLS encryption for supported web connections and cloud-provider encryption at rest for supported production storage and backups.
• Logical separation of company workspaces and access checks intended to prevent cross-company access.
• Restricted administrative access based on job need and least-privilege principles.
• One-way password hashing where TerraForeman-managed passwords are used; full passwords are not stored in readable form.
• Time-limited recovery tokens, login rate limits, and temporary lockouts designed to reduce automated account attacks.
• Monitoring, error logging, backups, recovery procedures, scoped credentials, software maintenance, and vulnerability remediation appropriate to the service's size and risk.

Payment Information

Stripe processes subscription checkout, payment methods, invoices, and the billing portal. We store limited customer and subscription references needed to connect an account to billing status, but do not store full payment-card numbers or card security codes. Stripe's own security and privacy terms apply.

Integrations and AI Processing

We limit integration access to permissions reasonably needed for customer-authorized features. Third-party providers maintain their own systems and security programs. When Scout uses an AI provider, we send the instructions and workspace context reasonably needed for the request. Do not submit data you are not authorized to process; review the Privacy Policy for details.

Customer Responsibilities

• Use unique, strong credentials and protect the identity account used to sign in.
• Enable multifactor authentication with supported identity providers whenever available.
• Limit workspace access to authorized personnel and promptly remove former workers or vendors.
• Protect devices, browsers, networks, downloaded files, API keys, and connected-service credentials.
• Review recipients, attachments, AI drafts, estimates, and customer data before sending or publishing.
• Promptly report suspected unauthorized access, misdirected information, or exposed credentials.

Security Incident Response

We investigate credible reports, contain verified incidents, preserve relevant records, restore service, and take corrective action appropriate to the circumstances. If an incident triggers a legal notification duty, we will notify affected parties and authorities as required by applicable law. Details may be limited while an investigation is active or when disclosure could increase risk.

Responsible Disclosure

Report suspected vulnerabilities privately to info@terraforeman.com with the subject SECURITY REPORT. Include the affected URL or feature, safe reproduction steps, potential impact, and supporting evidence.

Do not access or retain another company's data; use denial-of-service testing, phishing, malware, credential attacks, social engineering, or physical intrusion; disrupt production; publicly disclose an unresolved issue before reasonable investigation; demand payment; or threaten disclosure. TerraForeman does not operate a guaranteed bug-bounty program unless announced in writing.

Policy Review

We may update this policy as the product, providers, risks, or legal requirements change. Material changes affecting current customers will be communicated when required. The effective date identifies the version represented by this page.