'%20fill='%23000000'%20stroke='none'%3e%3cpath%20d='M%201784.53%205631.9%20C%201775.53%205618.9%201692.53%205479.9%201598.53%205322.9%20C%201395.53%204983.9%201355.53%204919.9%201342.53%204915.9%20C%201332.53%204912.9%201315.53%204938.9%201090.53%205311.9%20C%201023.53%205423.9%20960.53%205523.9%20951.53%205534.9%20C%20936.53%205549.9%20918.53%205552.9%20816.53%205552.9%20C%20751.53%205552.9%20696.53%205548.9%20692.53%205542.9%20C%20689.53%205537.9%20721.53%205475.9%20763.53%205405.9%20C%20806.53%205335.9%20855.53%205252.9%20872.53%205222.9%20C%20889.53%205192.9%20941.53%205106.9%20987.53%205032.9%20C%201032.53%204958.9%201161.53%204746.9%201272.53%204562.9%20C%201383.53%204378.9%201522.53%204147.9%201581.53%204050.9%20L%201689.53%203872.9%20L%201823.53%203872.9%20C%201897.53%203872.9%201957.53%203874.9%201957.53%203876.9%20C%201957.53%203879.9%201887.53%203997.9%201800.53%204139.9%20C%201513.53%204612.9%201487.53%204657.9%201487.53%204674.9%20C%201487.53%204697.9%201788.53%205192.9%201802.53%205192.9%20C%201807.53%205192.9%201830.53%205162.9%201852.53%205125.9%20C%201874.53%205088.9%201902.53%205042.9%201913.53%205023.9%20C%201925.53%205003.9%201993.53%204890.9%202065.53%204772.9%20C%202395.53%204228.9%202458.53%204121.9%202452.53%204112.9%20C%202448.53%204106.9%202382.53%204102.9%202287.53%204102.9%20C%202200.53%204102.9%202126.53%204098.9%202123.53%204094.9%20C%202120.53%204089.9%202147.53%204038.9%202183.53%203979.9%20L%202249.53%203872.9%20L%202563.53%203872.9%20C%202736.53%203872.9%202877.53%203875.9%202877.53%203878.9%20C%202877.53%203882.9%202812.53%203991.9%202734.53%204121.9%20C%202537.53%204445.9%202057.53%205239.9%201929.53%205452.9%20C%201801.53%205664.9%201804.53%205662.9%201784.53%205631.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3cpath%20d='M%202191.53%205539.9%20C%202187.53%205527.9%202443.53%205099.9%203052.53%204100.9%20L%203191.53%203872.9%20L%203324.53%203872.9%20C%203397.53%203872.9%203457.53%203874.9%203457.53%203876.9%20C%203457.53%203879.9%203366.53%204031.9%203255.53%204214.9%20C%203144.53%204397.9%202964.53%204696.9%202854.53%204877.9%20C%202744.53%205059.9%202607.53%205285.9%202550.53%205380.9%20L%202445.53%205552.9%20L%202321.53%205552.9%20C%202226.53%205552.9%202195.53%205549.9%202191.53%205539.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3cpath%20d='M%201029.53%204386.9%20C%201014.53%204360.9%20993.53%204325.9%20982.53%204308.9%20C%20970.53%204291.9%20938.53%204237.9%20909.53%204187.9%20C%20880.53%204138.9%20829.53%204053.9%20797.53%203999.9%20C%20764.53%203944.9%20737.53%203894.9%20737.53%203886.9%20C%20737.53%203874.9%20759.53%203872.9%20864.53%203874.9%20L%20991.53%203877.9%20L%201099.53%204049.9%20L%201207.53%204220.9%20L%201144.53%204326.9%20C%201110.53%204384.9%201076.53%204432.9%201069.53%204432.9%20C%201062.53%204432.9%201044.53%204411.9%201029.53%204386.9%20Z'%20style='fill:%20rgb(215,%2032,%2038);'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Trust, Security & Privacy
Last updated: 1 October 2026
This page is maintained by Scalexa to answer common security and privacy questions about scalexa.ai. It describes the controls on this website today. It is not an independent certification or audit.
Scope
This statement covers the public marketing website at scalexa.ai and the protected client-facing reports and dashboards hosted on the same site (for example the AWS WAFR dashboard and security assessment reports). It does not cover engagements delivered for clients in their own environments, which are governed by the contract in place for that engagement.
Authentication & access
- The public website does not require an account to browse.
- Protected client reports (e.g. AWS WAFR and password-gated security assessment reports) are guarded by a server-side password check, with short-lived signed access tokens stored in the browser session and re-verified on reload.
- Password verification runs in serverless edge functions; passwords are stored only as bcrypt hashes and are never returned to the browser.
Hosting & platform
- The website is built with React and Vite and served as a static front-end.
- Backend functionality (password verification, contact email delivery, protected file access) runs on Lovable Cloud (Supabase) edge functions.
- Protected client files are stored in private object storage and served through short-lived signed URLs; direct public access is denied.
- Traffic is fronted by Cloudflare, which provides TLS termination and standard edge protections.
Data we collect on this site
- Information you submit through the contact form (name, email, message, and any optional fields you choose to provide). This is used to respond to your enquiry and is delivered by email via our transactional email provider.
- Standard request metadata (IP address, user agent, referrer) processed by our hosting and CDN providers for delivery, security, and abuse prevention.
- Analytics and tag-management events when you accept analytics cookies — see the cookie section below.
For the full data-handling statement, see our Privacy Policy.
Subprocessors & integrations
The website relies on the following third parties to operate. Each is used only for the purpose described.
- Lovable Cloud (Supabase) — backend, edge functions, private storage.
- Cloudflare — CDN, TLS, and edge protection.
- Resend — transactional email delivery for contact form submissions.
- Google reCAPTCHA — bot protection on the contact form.
- Google Tag Manager & analytics — measurement, loaded only with consent.
- Calendly — meeting scheduling when you choose to book a call.
- YouTube — video embeds on selected pages (privacy-enhanced mode where supported).
Cookies & analytics
Non-essential cookies (analytics, marketing) are loaded only after you accept them via the cookie banner. You can review or change your choice at any time on the Cookie Preferences page.
Contact form protections
- Server-side input validation on all submitted fields.
- Google reCAPTCHA verification on the server before any message is sent.
- Generic error responses to avoid leaking internal details.
Retention & deletion
Contact-form messages are retained for as long as needed to respond to your enquiry and for reasonable record-keeping afterwards. To request access, export, or deletion of personal information you have submitted, use the Book a Free 30-Min Call button.
Reporting a security issue
If you believe you have found a vulnerability in scalexa.ai, please use the Book a Free 30-Min Call button with details and steps to reproduce. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate.
Compliance posture
Scalexa does not currently advertise independent certifications (such as SOC 2, ISO 27001, HIPAA, or PCI DSS) for this website. For client engagements, the applicable security, privacy, and compliance commitments are defined in the contract for that engagement. Please contact us if you need specific assurances for an evaluation or procurement process.