Trust
Security
SciExpert handles unpublished manuscripts, review reports and reviewer identity data. This page describes, in plain terms, the controls we operate today — no marketing claims and no certifications we do not hold.
Last updated 12 August 2026
Data protection in transit and at rest
Encrypted transport
All traffic to sciexpert.space and to our backend and storage endpoints is served over HTTPS/TLS. Plain HTTP requests are redirected.
Encrypted storage
Manuscripts, review reports, CVs and payment proofs are stored in private cloud object storage with encryption at rest provided by the storage platform.
No public file URLs
Uploaded files have no permanent public link. Downloads are served through short-lived signed URLs issued only after we check that the requester is allowed to read that file.
Keys stay server-side
Storage and AI provider credentials live only in server-side environment secrets and are never shipped to the browser or exposed in the extension.
Access control
Every database table that holds user content has row-level security enabled, so a query is evaluated against the signed-in user rather than trusting the client.
- A manuscript on an order is readable only by the author who uploaded it and the reviewer assigned to that order.
- Your library, projects, extractions, screening decisions and drafts are scoped to your account and are not visible to other users.
- Roles are stored in a dedicated roles table and checked server-side. Admin status is never derived from anything the browser can set.
- Reviewer real names, institution details and payout information are hidden from the public marketplace when a reviewer chooses to work under an alias.
Manuscript confidentiality
Unpublished work is the most sensitive thing on the platform, so it is handled as private by default:
- Uploads go straight to a private bucket — never to a public asset path.
- Replacing a file during an active order creates a new version; earlier versions are retained on the order record so the review history stays auditable.
- Reviewers see only the orders assigned to them, and lose access once an order is cancelled.
- Your files are never used to train models and are never sold or shared.
AI processing
Requests to AI models are made server-side. The browser never holds a model API key, and the prompt we send contains only the text needed for the service you invoked — for example the passage you asked to rewrite or the records returned by a search.
PDF text extraction for Chat with PDF and image forensics for Figure Integrity run in your own browser; only the extracted text you ask a question about leaves your device.
Payments
We do not store card numbers. Card payments are handled by the payment provider on their own infrastructure. For manual EGP transfers, we store only the transfer proof you upload and the payout details a reviewer supplies for being paid — both in private storage, readable only by the account owner and platform administrators.
Application and infrastructure practices
Least privilege
Service credentials that bypass access rules are used only in narrowly-scoped server code, never for ordinary reads.
Input validation
Server endpoints validate their input, and webhook and public API routes verify the caller before doing any work.
Dependency hygiene
Dependencies are kept current and reviewed for known advisories as part of ongoing maintenance.
Automated review
Database policies and access rules are re-checked with automated security scans as the schema changes.
Your controls
- Export your reference library and generated outputs at any time.
- Delete individual files, projects or your whole account.
- Reviewers choose which credential fields are public and which are admin-only.
- See exactly what we hold on the Your Data page.
Reporting a vulnerability
If you believe you have found a security issue, please tell us before disclosing it publicly. Email security@sciexpert.space with the steps to reproduce, the impact you observed, and anything we need to confirm it.
- We aim to acknowledge reports within 3 business days.
- Please do not run tests that degrade the service, access other people's data, or use social engineering against our users or staff.
- We will not pursue action against good-faith research that follows this guidance.