Scaup Security

Scaup writes to live websites, so we keep the access we ask for small, protect what you give us, and make every change easy to undo.

Your API key

• We store your key encrypted with AES-256-GCM. It is never stored as plain text.
• We never write keys or passwords to our logs. Our logs also remove email addresses and any credentials inside URLs before they are saved.
• We only need access to your pages, posts and the two site files. Give us a key that cannot reach users, orders or settings.
• You can rotate the key at any time. Send us the new one and we replace it.

What Scaup changes

• Only the fields listed on the Custom API page: page titles, descriptions, social sharing text, structured data, body text, links, image alt text, new articles, robots.txt and llms.txt.
• Body text uses a short list of plain HTML tags. We never send scripts, styles, frames or event attributes, and we ask your API to reject them.
• We never delete a page. To undo an article, we set it back to draft.

Your edits come first

• Before every change, Scaup reads the current value and saves it. This is what lets you undo the change later.
• Every write carries the version we read. If someone on your team changed the page since then, your API refuses the write and nothing is overwritten.
• You can choose to review changes before they go live, instead of letting them publish on their own.

Your data

• Every request inside Scaup checks that the person asking owns the site. One customer can never see another customer's site.
• We read your public pages and the content your API returns, so we can plan and make the changes.

Report a problem

If you find a security issue in Scaup or in this API, email [email protected] with "Security" in the subject.