1. Executive summary & security posture statement

Scalable is an AI image-generation SaaS operated by Machete Marketing Germany GmbH, a German limited-liability company (GmbH). We help brands produce on-brand product and marketing imagery using third-party generative AI models, with the application, data, and access governance built and operated by Scalable.

Our posture, stated honestly:

• Small, security-focused team (fewer than 20 people). We do not yet hold SOC 2 Type II or ISO 27001 certification. We do not claim controls we have not implemented. Where a measure is planned rather than live, this document says so.
• We build on certified infrastructure. Our hosting (Vercel), database/auth/storage (Supabase, EU/Frankfurt region), and payments (Stripe) providers maintain SOC 2 Type II, ISO 27001, and PCI DSS Level 1 assurance respectively. We inherit infrastructure-layer controls from them and operate the application layer ourselves. Section 6 states precisely what transfers and what does not.
• EU-first data residency. Customer data is stored in the EU (Supabase, Frankfurt). US processing is limited to AI model inference and is governed by Data Processing Agreements, EU Standard Contractual Clauses, and / or EU-US Data Privacy Framework certifications (Section 3).
• No model training on customer data. All AI providers are used under enterprise / API terms that exclude training on customer inputs and outputs by default. We rely on zero-retention or limited-retention modes where the provider offers them (Section 5).
• Shared-responsibility model. We document which controls we operate and which we inherit (Sections 4 and 6). Security tasks can be outsourced; accountability cannot, and we treat it as ours.

What we commit to in a procurement engagement: a signed Article 28 GDPR Data Processing Agreement, the full named sub-processor list under NDA with a 30-day change-notice commitment, completion of your security questionnaire (SIG-Lite / CAIQ / custom VSA), and a named privacy contact.

---

2. Company & service overview, and data flow

2.1 The entity and the service

2.2 Data-flow description (prose)

A typical request flows through four layers:

1. User → Scalable application (Vercel). The customer's browser connects over HTTPS (TLS 1.2+) to the Scalable web application, hosted on Vercel's global edge network. Vercel serves the front end and runs server-side application logic.
2. Scalable application → Supabase (EU / Frankfurt). Application requests authenticate against Supabase Auth and read/write data in a Postgres database hosted in the EU (Frankfurt region). Uploaded assets and generated images are stored in Supabase Storage. All connections use TLS in transit; data is AES-256 encrypted at rest. Tenant isolation is enforced in Postgres via Row-Level Security (Section 4).
3. Scalable application → AI providers. Image generation and editing call first-party APIs operated by Google and OpenAI, plus image-generation sub-processors Fal.ai and Kie.ai. Language and text analysis calls go to Google, OpenAI, and Anthropic (Anthropic is used for language only, not image generation). Only the data required for the request (prompt, reference images, generation parameters) is sent. All providers are engaged under no-training-by-default / enterprise terms, with zero- or limited-retention modes where available (Section 5).
4. Output → Supabase (EU). The generated image returns to the Scalable application and is stored back in Supabase Storage (EU) against the customer's tenant. The customer retrieves it over HTTPS.

Supporting flows. Billing is handled by Stripe (card data goes directly to Stripe; Scalable receives only tokens). Error monitoring uses Sentry with text and media masking enabled. Product analytics uses Mixpanel with EU data residency. Internal collaboration uses Google Workspace and Slack.

---

3. Data hosting & residency

3.1 Where US processing occurs, and the safeguards

The primary store of customer data is in the EU (Frankfurt). US processing is limited to:

• AI model inference, where the relevant provider processes outside the EU; and
• observability / analytics metadata, minimized at source.

For any transfer of personal data outside the EU/EEA, Scalable relies on one or more of:

• EU-US Data Privacy Framework (DPF) certification of the recipient, where available.
• EU Standard Contractual Clauses (2021 SCCs, Module 2/3) with the provider, supported by a Transfer Impact Assessment where the recipient is not DPF-certified.

The transfer mechanism is recorded per sub-processor in our sub-processor register, available under NDA (Section 7).

---

4. Technical & organizational measures (Art. 32 GDPR)

Article 32 GDPR is risk-based, not prescriptive: it requires confidentiality, integrity, availability, and resilience appropriate to the risk, the ability to restore availability after an incident, and regular testing of measures. Accountability for these measures rests with Scalable and cannot be outsourced. The table below frames each control as shared responsibility: what Scalable inherits from its providers, and what Scalable operates.

Documentation discipline. Each control above is stated at the level we can substantiate. Items marked TODO are not yet confirmed and must not be represented as live until verified.

---

5. AI governance

5.1 No training on customer data

All AI providers — Google, OpenAI, Anthropic, Fal.ai, and Kie.ai — are engaged under enterprise / API terms that exclude training on customer inputs and outputs by default. Customer data is not used to train, fine-tune, or improve any provider's models. Where a provider offers a zero-retention or limited-retention mode, Scalable uses it.

5.2 EU AI Act posture

Scalable's roles under the EU AI Act:

• Provider of its own AI system — Scalable designs the application, pipeline, guardrails, and UI and places the system on the EU market under its brand.
• Deployer of upstream general-purpose AI (GPAI) — Scalable uses third-party models under its authority. Scalable is not a GPAI provider, as it does not retrain models beyond the threshold that would transfer GPAI-provider obligations.

Generative-image features sit in the limited-risk transparency layer (Article 50), not the high-risk category.

Article 50 transparency (applies from 2 August 2026):

• Interactive disclosure that users are interacting with an AI system.
• Marking of AI-generated output as machine-readable / detectable. Machine-readable watermarking obligations apply from 2 December 2026.

5.3 Human-in-the-loop and output review

Generation is initiated and reviewed by the customer. Outputs are presented for human selection and editing; the customer controls which outputs are kept, exported, or published, and remains the deployer responsible for any deepfake / public-interest labelling at the point of exposure under Article 50(4).

---

6. Inherited certifications

Scalable does not hold SOC 2 or ISO 27001 certification. It operates on infrastructure that does. The table below cites each provider's assurance precisely and states what Scalable inherits — a provider's certification covers that provider's environment, not Scalable's.

Evidence. Provider attestation reports (SOC 2, Stripe's official PCI Attestation of Compliance) are available from the respective providers under their own terms, and Scalable can point enterprise reviewers to them. Scalable does not redistribute third-party reports except as each provider permits.

---

7. Privacy & GDPR program

7.1 Controller / processor roles

• Processor — for personal data that customers upload or generate through the service, Scalable acts as a processor on the customer's documented instructions. The customer is the controller.
• Controller — for Scalable's own account, billing, and marketing data, Scalable is the controller.

7.2 Data Processing Agreement (Art. 28)

Scalable offers a pre-drafted Article 28 GDPR Data Processing Agreement with a modular annex structure (processing details, technical and organizational measures, authorized sub-processors). It can be executed electronically. The DPA incorporates EU Standard Contractual Clauses for international transfers where applicable.

7.3 Sub-processor list and change notice

Scalable uses a three-tier disclosure model consistent with GDPR Art. 28 and EDPB Opinion 22/2024:

1. Categories (shareable): cloud infrastructure, database/auth/storage, payments, AI model inference, error monitoring, product analytics.
2. Full named list (under NDA / on request): name, role, purpose, location, data categories, and transfer mechanism for each sub-processor — including Vercel, Supabase, Stripe, Google, OpenAI, Anthropic, Fal.ai, Kie.ai, Sentry, and Mixpanel.
3. On contractual request: underlying DPAs and assessments for higher-risk processing.

Change notice: Scalable commits to 30 days' advance notice of a new or replaced sub-processor, with a right to object on reasonable data-protection grounds, leading to good-faith resolution or termination of the affected service without penalty.

7.4 Data-subject requests

Scalable assists controllers with data-subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection) and forwards any request received directly to the relevant controller.

7.5 Data Protection Officer

A statutory Data Protection Officer is not currently mandatory for Scalable under § 38 BDSG, given team size and processing scope. Privacy matters are handled by a named privacy contact reachable at legal@scalable.so.

---

8. Identity & access, data retention & deletion, business continuity

8.1 Identity & access

• Customer authentication: hashed passwords (via Supabase Auth) and magic-link sign-in; session management with inactivity / single-session controls; short-lived JWTs with refresh tokens.
• Internal access: least privilege, named accounts, onboarding/offboarding procedures, periodic access reviews.

8.2 Data retention & deletion

• Customer data is retained for the life of the account. On termination, data is exported on request and deleted from production within a defined window, with backups aging out per the Supabase backup/PITR retention period. Legal-retention carve-outs apply where required.

8.3 Business continuity

• Availability: Vercel global edge with regional failover and DDoS mitigation; Supabase 99.9% platform SLA.
• Backup & recovery: Supabase daily encrypted backups and Point-in-Time Recovery; environment separation (dev / preview / prod).

---

9. Responsible disclosure & compliance roadmap

9.1 Responsible disclosure / vulnerability reporting

Scalable welcomes good-faith security research. Report suspected vulnerabilities to security@scalable.so.

We ask researchers to avoid privacy violations, data destruction, and service degradation, and to give us reasonable time to remediate before disclosure.

9.2 Compliance roadmap (forward-looking, non-binding)

The following is a directional roadmap, not a commitment, and may change:

Scalable's current practices are designed to align with GDPR Article 32. We do not claim any certification we do not hold.

---

10. Security questionnaire support

Scalable supports enterprise vendor-risk processes and will:

• Complete SIG-Lite, CAIQ (incl. CAIQ-Lite), or a custom Vendor Security Assessment (VSA).
• Enter into a Non-Disclosure Agreement before sharing the full named sub-processor list, the DPA, and any provider attestation references.
• Provide the Article 28 DPA for signature and the NDA-gated sub-processor register with per-sub-processor transfer mechanisms.
• Point reviewers to provider attestations (SOC 2, ISO 27001, Stripe PCI AoC) at the providers' Trust Centers.

To start a review, contact legal@scalable.so.

---

11. Contact

---

This document supports a vendor-security review. It describes Scalable's current security posture and forward-looking intentions. Forward-looking statements (including the compliance roadmap) are non-binding and subject to change. This document does not form part of any contract unless expressly incorporated by a signed agreement.