How your material is actually stored.

1. Where it runs

Scout Lane runs on dedicated infrastructure at IONOS SE in Germany. Application servers, the PostgreSQL database, the media volume and the backup copies are all in the same EU jurisdiction. There is no US region, no global replication and no CDN holding copies of your frames in fifty cities.

Every connection is HTTPS. The site is served over TLS 1.2 and 1.3 only, with HSTS enabled and certificates renewed automatically. Plain HTTP is redirected, never served. Custom gallery domains get their own certificate through the same automated pipeline.

The marketing site, the admin app, the client gallery and the field upload portal are static HTML, CSS and JavaScript. There is no build step and no third-party JavaScript of any kind on any page, which is the shortest possible route to a page that cannot leak what it is displaying.

2. Passwords and sessions

Staff passwords and client gallery passwords are hashed with Argon2id — 64 MiB of memory, three passes, two lanes, a 16-byte random salt and a 32-byte hash. That is comfortably above the OWASP floor and takes roughly 50 ms per verification, which also means a burst of login attempts cannot be turned into a CPU denial of service. Passwords are never stored, logged or emailed in the clear.

Hashes imported from an older system are upgraded to Argon2id the first time that person signs in successfully, so a migration does not leave weak hashes sitting in the table forever.

Session tokens are opaque random strings. What lands in the database is an HMAC-SHA-256 of the token, keyed with a server-side secret — so a database dump contains nothing that can be replayed as a session, and it cannot be attacked with a rainbow table either. Sessions expire: one hour for a staff access token, thirty days for a refresh token, fourteen days for a client gallery session. Every session is listed in the app and can be revoked individually.

Login is throttled: eight failed attempts lock the account for fifteen minutes. Every route a stranger can reach — gallery login, the lead form, the public workspace lookup — carries its own rate limit.

3. Tenant isolation

Every row that belongs to a customer carries an organisation id, and every query that reads or writes one carries AND org_id = …, taken from the authenticated principal — even when the primary key alone would already be unique. A UUID is an identifier, not an authorisation check, and the codebase treats it that way without exception.

On disk the same boundary is physical. Files live at o/{org}/p/{project}/…, one subtree per workspace. A single module owns path construction; nothing else in the codebase concatenates a path. Every key is resolved against the storage root and any key that tries to escape it is refused before it reaches the filesystem.

Client logins are scoped tighter still. A guest belongs to exactly one project, and can optionally be restricted to named categories or folders inside it. A guest who is scoped to Locations cannot see Casting — not in the gallery, not in search, not by requesting a media id directly, because the same access rule is implemented once and applied by the gallery, the media route and the download builder alike.

4. Serving a photo

The application never streams media bytes itself. It performs the authorisation check and answers with an internal redirect; nginx then sends the file from a location that is not reachable from outside. There is no public, guessable URL for a stored file anywhere on the platform — the only way to a frame is through a request that was authorised first.

Media URLs are signed. The signature covers the storage key, an expiry and the id of the session that asked for it, under HMAC-SHA-256. A link copied out of a gallery and pasted into a group chat stops working when it expires — six hours by default — and does not work at all for anyone holding a different session. ZIP downloads are built as a job and handed over through a one-shot link tied to the request that created them.

Derivatives — the 400, 900 and 1800 pixel versions the grid actually loads — live under the same per-tenant subtree and are served through the same authorisation check as the original. There is no "thumbnails are public because they are small" shortcut.

5. Caching

Every media response carries Cache-Control: private. Derivatives get private, max-age=86400, so the viewer's own browser can keep them and the gallery stays fast on 4G; everything else gets private, no-store. The word private is the point: no shared cache, no corporate proxy and no CDN is permitted to hold a copy of one customer's client's material and hand it to the next person who asks.

The gallery manifest — the single request that paints the whole client view — is private, no-store as well. The one asset served publicly is a workspace's own logo, because it is painted on a login screen anybody can open.

6. Deletion

Deleting a photo, a folder or a project marks it deleted immediately. It disappears from every read in the same instant — reads filter on it unconditionally — and a background purge job then removes the bytes from disk. Deleting a workspace removes its entire storage subtree the same way.

Deleted material stays in the nightly backups until those backups age out, which is the honest version of the sentence most vendors write as "deleted immediately". Retention and the process for an early, verified erasure are set out in the privacy policy.

7. Backups

The database is backed up nightly with continuous write-ahead log archiving, which allows point-in-time recovery rather than only a restore to last midnight. Backups are encrypted at rest, held in the EU, and kept for 30 days. Restores are rehearsed on a schedule, because a backup nobody has restored is a rumour.

Media sits on redundant disks with a second copy held separately from the primary volume. Original files are never modified after upload; derivatives are regenerated from the original, so a corrupted thumbnail is a rebuild rather than a loss.

8. What we collect

Two different things end up on this platform: the data we need to run the business, and the material our customers put here for their own clients. The second category is the customer's, and we act only on their instructions.

The salted IP hash is worth being explicit about. Analytics needs to answer "is this the same viewer as five minutes ago", not "who is this viewer". A keyed hash answers the first question and cannot answer the second: raw IP addresses — personal data under the GDPR — are never written to the database at all.

9. What we do not

• No raw IP addresses in the database, for staff or for viewers.
• No third-party analytics, no advertising pixels, no session recording, no heat maps.
• No cookies other than the session cookie that keeps you signed in. Nothing to consent to, because there is nothing tracking you.
• No card numbers. Payment details go straight to our payment processor and never touch our servers.
• No training of machine learning models on customer media, by us or by anyone we hand it to.
• No face recognition, no automatic tagging, no content scanning beyond what is needed to build a thumbnail.
• No selling, renting or sharing of customer data with anyone outside the sub-processors listed below.

10. Sub-processors

The complete list of third parties that can touch customer data. It is short on purpose. Customers on a signed data processing agreement are notified before anyone is added.

The email provider row is a placeholder: the SMTP relay is configured per deployment and the founder confirms the named vendor before launch.

11. Reporting a flaw

Write to security@scoutlane.com with enough detail to reproduce it. We confirm receipt inside two working days and tell you what we found and when it will be fixed. We will not take legal action against anyone who reports a genuine flaw in good faith, tests only against their own workspace, and gives us a reasonable window before publishing.

Please do not run automated scanners against production, and never use another customer's data to demonstrate a finding.

Last updated 12 September 2026.