Skip to content

Understand
the boundary.

Where Scout runs, what data moves, and how to review a deployment with us.

Discuss security

Review the details.

The local CLI, hosted workspaces, and private deployments have different data flows. Confirm the controls for the setup you choose.

How Scout handles data

The software runs on your machine

The Scout CLI executes locally. Strategy code, market data pulls, and backtests run in your environment, not on our servers.

Your keys stay yours

In a local CLI workflow, keys come from your configuration and authenticate requests to your selected providers. Hosted and enterprise deployments have their own credential controls.

Entitlement checks are limited

Website license checks accept entitlement fields, not positions, trades, or strategy code. What a research workspace sends to model and data providers depends on its configuration.

Enterprise deploys inside your boundary

Enterprise installs run in your own VPC, cloud account, or on-prem host, and connect only to systems you approve.

Generated code is inspectable

Every strategy Scout produces is readable Python you can review, diff, and version before it touches a broker.

Minimal service-side data

Licensed installs verify entitlement using a one-way hash of the license key and a device identifier. That check carries no trading data.

Data flows by product

Scout CLI (open source)

Runs in
Your machine
Data that leaves
Configured model, broker, and data-provider requests can leave your machine. Review your installed version and configuration for other service calls.

Licensed Scout Pro

Runs in
Your machine
Data that leaves
Hashed license and device identifiers, plus supported organization, version, package, and timestamp fields. Configured provider requests also apply.

Scout Research

Runs in
Your cloud or VPC
Data that leaves
Sessions are processed in the deployment environment. Configured integrations can send data to their providers; confirm controls for your deployment.

Billing

Runs in
Stripe
Data that leaves
Email and payment details handled by Stripe. We never store full card numbers.

This website

Runs in
Vercel
Data that leaves
Forms go to Formspree, hosting requests to Vercel, and enabled signup confirmations through Resend. This website also loads Google Analytics.

Security posture

Deployment model
Local CLI; hosted or private workflows depend on the agreed deployment
Credential handling
Local CLI stores keys locally; configured connections use them for authentication
Data residency
Determined by your deployment, not by us
Payment processing
Stripe; no card numbers stored by Scout
Source availability
Core CLI is open source and auditable
Subprocessors
Vercel (hosting), Formspree (forms), Stripe (billing), Resend (enabled signup emails), Google Analytics (website analytics)

Scout does not yet hold a SOC 2 attestation. If your review requires formal certification, raise it on the scoping call.

Documents

Report a vulnerability

Email reproduction steps to our team and give us a reasonable window to respond before public disclosure.

jaimin@finnyai.tech