Enterprise adds volume, a signed agreement and invoicing.
Every plan runs the same checks. Enterprise, from €990 a month, is for more than Scale’s 1,000,000 visitor checks a month: a volume set to your traffic, contractual service levels in a signed agreement, and billing by invoice. Tell us the volume you expect: it goes straight to the founder.
The documents a security review asks for
| Data Processing Agreement | Article 28 of the UK and EU GDPR. It binds on acceptance of the Terms, with no signature; a countersigned copy and the Standard Contractual Clauses / UK IDTA package are on request. Read it or get the PDF. |
| Security whitepaper | The architecture, the controls in place today and how long data is kept. Read it or get the PDF. |
| Sub-processors | Each provider and its region, with a dated change log where a new sub-processor of customer data is announced at least 30 days ahead. See the list. |
| Service levels | Published aims, not guarantees; contractual service levels come only in a signed agreement. Incidents are on the status page. |
| Data location | The server and the database run on Cloudflare in the United States. EU-only processing is not available today. |
| Certifications | Maskbreak is not independently certified: SOC 2 Type II is at the pre-audit stage, and no third-party penetration test has been commissioned yet. We will publish the audit firm and scope when an engagement is signed. |
| Security questionnaires | CAIQ, SIG Lite or your own, handled directly by the founder. |
| Contract | The Terms of Service, or a Master Services Agreement negotiated directly with the founder. |
The rest of what is true about security and data handling is on one page: Trust & security.