Security at SmartScanit Group
Last updated: 21 July 2026 · Version 1.0
Our customers put working documents — bank statements, ledgers, tax records, forensic evidence — into our platform. This page describes the controls that protect them.
Isolation by tenant
Every LedgerSense customer firm is a distinct tenant. Matter records, uploaded documents and audit trails are partitioned by tenant identifier at every layer — Airtable base, Supabase storage, Cloudflare KV, MCP request scope — with defence-in-depth policies on top.
OAuth 2.1 + PKCE for the MCP
The LedgerSense MCP endpoint uses OAuth 2.1 with PKCE and self-service dynamic client registration. Tokens are RS256-signed JWTs with a published JWKS. There is no shared bearer token, no dev-token bypass in production, and every token is bound to a specific tenant.
Least-privilege storage
Statement uploads write through a service-role server route; anonymous read and insert policies on the storage bucket are disabled. Leads are captured through a fail-closed policy — insert only, staff read via service role. Every write path has a matching read control.
Audit chain on every matter
Every LedgerSense action — document ingest, categorisation, submission, schedule production — is written to an append-only audit trail with a scalar tenant identifier and a matter identifier. The full chain is queryable per matter and forms part of the working papers.
Managed platforms, no self-hosted secrets
We run on Cloudflare Workers, Supabase and Airtable. Secrets live in each platform's managed store; there are no long-lived credentials in the codebase and no infrastructure we operate on our own hardware.
Vulnerability disclosure
If you believe you have found a security issue, tell us privately at security@smartscanitgroup.co.uk. We acknowledge within one working day, keep you updated as we investigate, and credit reporters who ask to be credited. Please do not test destructively or against other customers' data.
LedgerSense — our flagship product — runs as a Model Context Protocol server on Cloudflare Workers, backed by Airtable for matter records and Supabase for uploaded documents. The client-facing site (this one) is a React application hosted by Lovable, with Supabase for authenticated storage and Resend for transactional email.
All connections between clients, the site, the MCP endpoint and our sub-processors are TLS-terminated at the edge. The MCP endpoint accepts only OAuth 2.1 JWTs issued by our authorisation server; every tools/list and tools/call request is scoped to the tenant embedded in the token.
Airtable data is partitioned by scalar tenant and matter identifiers as well as by linked-record references, so per-tenant reads succeed under filterByFormula and cross-tenant reads fail closed. Supabase storage buckets that hold uploaded statements are locked down; ingestion happens through a service-role route rather than direct anonymous writes.
A current list of sub-processors, their purpose and their region is maintained in our Privacy Policy. We treat that list as authoritative to avoid drift.
We aim to detect, contain and communicate about incidents on the same day they are identified. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Information Commissioner's Office within 72 hours as required by the UK GDPR, and inform affected customers without undue delay.
Post-incident, we write a private root-cause note for the affected customer and retain it for our own audit chain. Where the incident is systemic and non-specific to a customer, we publish a redacted summary.
Email security@smartscanitgroup.co.uk. Please include steps to reproduce, the affected endpoint or page, and (if you're able) a suggested severity. Do not test destructively or against another customer's data.
SmartScanit Group Ltd · Company number 17311565 · Registered office 66 Paul Street, London EC2A 4NA · ICO registration ZC189364.