Trust
Security
SciExpert handles unpublished manuscripts, review reports and reviewer identity data. This page describes, in plain terms, the controls we operate today — no marketing claims and no certifications we do not hold.
Last updated 12 August 2026
Data protection in transit and at rest
Encrypted transport
All traffic to sciexpert.space and to our backend and storage endpoints is served over HTTPS/TLS. Plain HTTP requests are redirected.
Encrypted storage
Manuscripts, review reports, CVs and payment proofs are stored in private cloud object storage with encryption at rest provided by the storage platform.
No public file URLs
Uploaded files have no permanent public link. Downloads are served through short-lived signed URLs issued only after we check that the requester is allowed to read that file.
Keys stay server-side
Storage and AI provider credentials live only in server-side environment secrets and are never shipped to the browser or exposed in the extension.
Access control
Every database table that holds user content has row-level security enabled, so a query is evaluated against the signed-in user rather than trusting the client.
- A manuscript on an order is readable only by the author who uploaded it and the reviewer assigned to that order.
- Your library, projects, extractions, screening decisions and drafts are scoped to your account and are not visible to other users.
- Roles are stored in a dedicated roles table and checked server-side. Admin status is never derived from anything the browser can set.
- Reviewer real names, institution details and payout information are hidden from the public marketplace when a reviewer chooses to work under an alias.
Manuscript confidentiality
Unpublished work is the most sensitive thing on the platform, so it is handled as private by default:
- Uploads go straight to a private bucket — never to a public asset path.
- Replacing a file during an active order creates a new version; earlier versions are retained on the order record so the review history stays auditable.
- Reviewers see only the orders assigned to them, and lose access once an order is cancelled.
- Your files are never used to train models and are never sold or shared.
AI processing
Requests to AI models are made server-side. The browser never holds a model API key, and the prompt we send contains only the text needed for the service you invoked — for example the passage you asked to rewrite or the records returned by a search.
PDF text extraction for Chat with PDF and image forensics for Figure Integrity run in your own browser; only the extracted text you ask a question about leaves your device.
Payments
We do not store card numbers. Card payments are handled by the payment provider on their own infrastructure. For manual EGP transfers, we store only the transfer proof you upload and the payout details a reviewer supplies for being paid — both in private storage, readable only by the account owner and platform administrators.
Application and infrastructure practices
Least privilege
Service credentials that bypass access rules are used only in narrowly-scoped server code, never for ordinary reads.
Input validation
Server endpoints validate their input, and webhook and public API routes verify the caller before doing any work.
Dependency hygiene
Dependencies are kept current and reviewed for known advisories as part of ongoing maintenance.
Automated review
Database policies and access rules are re-checked with automated security scans as the schema changes.
Enterprise-grade add-ons
Labs, departments and publishers can layer the following controls on top of a Team plan. These are arranged per agreement rather than switched on by default — contact security@sciexpert.space to scope them.
Single sign-on (SAML / OIDC)
Sign in with your institution's identity provider, with SCIM-style provisioning and de-provisioning so leavers lose access with the account they left behind.
Enforced two-factor
Require TOTP two-factor for every member of your organisation, with an admin view of who has enrolled and who has not.
Audit log export
Stream or export the account activity log to your own SIEM, with a longer retention window than the in-app 90-day view.
Client-side manuscript vault
Seal files in the browser with AES-256-GCM before upload, so the stored object reveals nothing but its size. Passphrases never reach our servers.
Custom data retention
Agree a retention and deletion schedule for manuscripts, review reports and AI run logs, including immediate purge on project close.
Data processing agreement
A signed DPA with GDPR sub-processor disclosure, breach-notification timelines and named contacts for your data protection officer.
Named reviewer confidentiality
Bespoke NDAs and conflict-of-interest rules applied to every reviewer matched to your submissions, enforced by the matching engine.
Private AI routing
Pin AI processing to a specific model provider or region, or bring your own provider key so prompts never touch shared inference capacity.
Security review support
We complete your vendor security questionnaire, supply an architecture and data-flow summary, and support a scoped penetration test.
Priority incident response
A contractual response and remediation window for security incidents, with a named contact and post-incident report.
SciExpert is an enterprise platform built on cloud infrastructure. Where an add-on is delivered by a downstream provider — storage, payments or model hosting — we will name that provider before you sign.
Your controls
- Export your reference library and generated outputs at any time.
- Delete individual files, projects or your whole account.
- Reviewers choose which credential fields are public and which are admin-only.
- See exactly what we hold on the Your Data page.
Reporting a vulnerability
If you believe you have found a security issue, please tell us before disclosing it publicly. Email security@sciexpert.space with the steps to reproduce, the impact you observed, and anything we need to confirm it.
- We aim to acknowledge reports within 3 business days.
- Please do not run tests that degrade the service, access other people's data, or use social engineering against our users or staff.
- We will not pursue action against good-faith research that follows this guidance.