System inventory
Every system and account SCOPE runs on, who owns it, who pays, and who has access (OW-5, OW-7). It is also the first half of the system description (ORG-10). Read from the repository, GitHub and Vercel on 27 Oct 2026. A blank marked [Dan] or [Kyle] is only visible in a dashboard.
Review: every quarter with the access review, and whenever a service is added or removed.
The boundary
The audit boundary (Dan, 28 Oct): everything in a Lucent Axis account, and nothing else. Dan's personal GitHub repo, Vercel projects and Supabase project are Paul's demo on synthetic data and are not tested against the requirements.
In: the SCOPE web app (apps/web, one Next.js app for every persona), its database, sign-in
and file storage, the code repositories and CI, and the AI add-on Spotter where a tenant has it
switched on.
Carved out (CC6.4, TS-8): physical security of the data centres is the subservice organisations' own: Supabase (which runs on Amazon Web Services) and Vercel. Our report relies on their SOC 2 reports, read yearly with their CUECs (VN-1, subprocessors.md).
Out (for Type I): COFI (/cofi), the financial dashboards, until a COFI client asks (ORG-35).
The hub (/hub) is internal and is not built into a client's deployment. The sample data set is
synthetic and contains no real employee data.
Services
| Service | What SCOPE uses it for | Account today | Owner today | Billing | Who has access | Move to |
|---|---|---|---|---|---|---|
| GitHub | Code (lucent-axis/scope), CI (GitHub Actions) |
lucent-axis org, Team plan |
Kyle (only org owner) | [Kyle] | Org members: Dan, Kyle. Repo admins: Dan, Kyle | Already company (OW-1) |
| Vercel (personal, OUTSIDE the boundary) | Paul's demo scope-safety-poc and scope-novvia |
Dan's personal account danielsgalia-6070's projects |
Dan | Dan, Pro | Dan | Paused after Paul's switch (OW-2) |
| Vercel (company copy) | scope-web, built from lucent-axis/scope main; live at scope.lucent-axis.com since 4 Nov (scope-web-mauve.vercel.app since 28 Oct, still answering), with Production env vars and the demo on the company database |
Team lucent-axis (Lucent Axis), created 27 Oct |
Kyle (only Owner) | Lucent Axis, Pro plan on trial | Kyle Owner, Dan Member (raised from Developer 28 Oct); MFA enforced | Already company (OW-2) |
| Supabase (company copy) | Postgres database, sign-in, file storage (five private buckets) for scope-web |
Project scope-dev, ref zvxabodonzynkxmcpbji, in the organization Lucent Axis (mrygzzsppachkizwuwkp); connected to the Lucent Axis Vercel team through the Supabase integration, 27 Oct. Holds the demo's data, copied from the personal project 28 Oct, despite its name |
Kyle (only Owner) | Lucent Axis, Pro plan | Kyle Owner, Dan Developer (joined 28 Oct); MFA on for both members; organization enforcement off (Owner switch, ID-1) | Already company (OW-3) |
| Supabase (personal, OUTSIDE the boundary) | Paul's demo database | Dan's own organization | Dan | Dan | Dan | Paused after Paul's switch |
| Anthropic | Spotter's model, demo only, when SPOTTER_MODEL_PROVIDER=anthropic |
[Dan] | [Dan] | [Dan] | [Dan] | Lucent Axis org |
| AWS Bedrock | Spotter's model in client builds (SPOTTER_MODEL_PROVIDER=bedrock) |
Not set up yet | Lucent Axis AWS account, created there | |||
| Google Workspace | Company email and documents | [Kyle] | [Kyle] | [Kyle] | Staff | Already company (confirm) |
| Domain registrar | None: apps are on *.vercel.app |
Company registrar if a domain is bought (OW-4) | ||||
| Password vault | Not chosen | Company vault (OW-6) | ||||
| Compliance platform | Not chosen (ORG-04) |
Outside the boundary, and not in the table: Dan's personal repo daniel-sgalia/scope-safety-poc
(the mirror Paul demos from, archived after his switch) and lucent-axis/novvia (set aside 28
Oct; Novvia will be cloned from lucent-axis/scope). Neither is tested against the requirements.
No email-sending, error-tracking, analytics or uptime service is installed (checked in
package.json and the code on 27 Oct). Add each one here the day it is added to the code.
Plans and settings to confirm (ORG-32, VN-4, AV-2, LM-1)
| Question | Supabase | Vercel |
|---|---|---|
| Plan | Lucent Axis organization: Pro (read in the dashboard 28 Oct) | Personal team: Pro. Lucent Axis team: Pro, on trial (read from the Vercel API 28 Oct) |
| Region | scope-dev: East US (North Virginia), us-east-1 (28 Oct) |
iad1, Washington, D.C., US: scope-safety-poc, scope-novvia and scope-web (read 28 Oct) |
| Point-in-time recovery | Off on scope-dev (a paid add-on; only an Owner can enable it, a Developer can only request it) |
n/a |
| Backup retention | Daily physical backups on scope-dev, two listed on 28 Oct (27 Oct 18:20 and 28 Oct 06:46 UTC). Both predate the demo data copied in on 28 Oct, so the first backup holding it is the night of 28 Oct. Storage files are not in database backups |
n/a |
| Log retention | Pro: 7 days (vendor pricing page, read 28 Oct; to confirm on the billing page) | Pro: runtime logs 1 day, 30 with Observability Plus (vendor pricing page, read 28 Oct; to confirm on the billing page) |
| Log drains available | Yes on Pro, as a paid add-on per project (to confirm on the billing page) | Yes on Pro, billed per GB (to confirm on the billing page) |
| SAML SSO for our own team | Dashboard SSO is on the Team plan, not Pro (to confirm on the billing page); not required for us (MFA plus the access review) | An Enterprise feature (to confirm on the billing page); not required for us (MFA plus the access review) |
Secrets
Where each secret lives. The rotation list and order are in this-week.md.
| Secret | Lives in | Reaches the browser? | Rotation |
|---|---|---|---|
NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY |
Vercel env, .env.local |
Yes, by design (RLS is the wall) | At each account move, then yearly |
NEXT_PUBLIC_DEMO_PASSWORD |
Vercel env, .env.local |
Yes: a known gap (SC-1) | At each move; removed from the bundle by SC-1 |
SUPABASE_DB_URL (database password) |
.env.local on Dan's laptop |
No | At each move, then yearly; vault only |
ANTHROPIC_API_KEY |
Vercel env (demo project) | No, server side | At each move, then yearly |
SPOTTER_AWS_REGION |
Vercel env (client builds) | No | Not a secret |
| CLI tokens (Vercel, Supabase, GitHub) | Laptops | No | Revoked at offboarding and at each move |
SUPABASE_SERVICE_ROLE_KEY, SUPABASE_SECRET_KEY, SUPABASE_JWT_SECRET, POSTGRES_* |
Vercel env, scope-web Preview and Development (put there by the Supabase integration) |
No, server side | Unused by the app; delete with DB-7 |
Data flows
- A driver, supervisor, GM or VP signs in in the browser (Supabase Auth, email and password today) and gets a session token.
- The browser reads and writes the database directly through Supabase's API with that token. Row-level security decides what each person sees. There is no server of ours in between (NP-1 is the plan to add one).
- Photos and documents go from the browser to private Supabase Storage buckets and come back only through signed links that expire within an hour.
- The offline DVIR keeps unsent inspections in the tablet's browser storage (IndexedDB) until the server confirms them.
- Spotter, where switched on, sends the VP's typed question and a fixed description of the
report building blocks to the model provider from a Vercel server function. Database rows
are not sent (
packages/spotter/src/model/provider.ts); the answer is read from the database afterwards, under the VP's own token. - Code goes from a laptop to GitHub; CI type-checks, tests and scans for secrets; Vercel builds
from GitHub. Database migrations are applied by hand with
supabase db push(SC-6).
People with access
| Person | GitHub | Vercel | Supabase | Database password | Laptop |
|---|---|---|---|---|---|
| Dan | Org member, repo admin | Owner (personal account); Member on the Lucent Axis team | Owner of his own organization; Developer in Lucent Axis (joined 28 Oct, MFA on) |
Yes | Personal |
| Kyle | Org owner, repo admin | Owner of the Lucent Axis team; none on the personal account | Owner of Lucent Axis (only Owner) |
[Dan] | Personal |